Jacobian group element adder

ABSTRACT

An objective is to obtain a Jacobian group element adder that can calculate addition in a Jacobian group of a C ab  curve at a high speed, and can enhance practicality of the C ab  curve.  
     An algebraic curve parameter file A  10,  and Groebner bases I 1  and I 2  of ideals of a coordinate ring of an algebraic curve designated by this file A are input into an ideal composition section  11  to perform arithmetic of producing a Groebner basis J of an ideal product of the ideal generated by I1 and ideal generated by I2. In a first ideal reduction section  12,  arithmetic is performed of producing a Groebner basis J* of an ideal that is smallest in a monomial order designated by the file A among ideals equivalent to an inverse ideal of an ideal that J in the coordinate ring of the algebraic curve designated by the file A generates. In a second ideal reduction section  13,  arithmetic is performed of producing a Groebner basis J** of a ideal that is smallest in the monomial order designated by the file A among ideals equivalent to an inverse ideal of an ideal that this J* generates to output it.

BACKGROUND OF THE INVENTION

[0001] The present invention relates to a Jacobian group element adder,and more particularly technology for discrete logarithmic cryptographyemploying a Jacobian group of an algebraic curve (hereinafter, referredto as algebraic curve cryptography) that is a kind of the discretelogarithmic cryptography, which is cryptography technology asinformation security technology.

[0002] It is an elliptic curve cryptography that has come in practicemost exceedingly among the algebraic curve cryptography. However, anelliptic curve for use in the elliptic curve cryptography is a veryspecial one as compared with a general algebraic curve. There is theapprehension that an aggressive method of exploiting its specialty wouldbe discovered in the near future. For this, so as to secure safety morereliably, a general algebraic curve of which specialty is lower isdesirably employed. C_(ab) curve cryptography is known as an algebraiccurve cryptography capable of employing a more general algebraic curveas mentioned above.

[0003] The C_(ab) curve cryptography, however, is less employed in theindustrial field as compared with the elliptic curve cryptography. Itsmain reason is that the conventional additive algorithm in the Jacobiangroup of the conventional C_(ab) curve is tens of times slower thanadditive algorithm in the Jacobian group of the elliptic curve, and as aresult, process efficiency of encryption/decryption in the C_(ab) curvecryptography is remarkably inferior as compared with the elliptic curvecryptography, which was shown in “Jacobian Group Additive algorithm ofC_(ab) Curve and its Application to Discrete Logarithmic Cryptography”by Seigo Arita, Japanese-version collection of The Institute ofElectronics, Information and Communication Engineers, Vol. J82-A, No.8,pp.1291-1299, 1999.

[0004] Also, another additive algorithm in the Jacobian group of theC_(ab) curve was proposed in “A Fast Jacobian Group Arithmetic Schemefor Algebraic Curve Cryptography” by Ryuichi Harasawa, and Joe Suzuki,Vol. E84-A No.1, pp.130-139, 2001 as well; however, even though anasymptotic calculation quantity of algorithm was given, no executionspeed data in a packaging experiment was shown, and, also, no report onthe packaging experiment by a third party was provided, and the extentto which the execution speed can practically be achieved is uncertain.

[0005] As seen from the foregoing, non-efficiency of the additivealgorithm in the Jacobian group of the C_(ab) curve prevents thecryptography of the above curve from coming in practice, which givesrise to the necessity of executing addition in the Jacobian group of theC_(ab) curve at a high speed.

DISCLOSURE OF THE INVENTION

[0006] The present invention has been accomplished in consideration ofsuch problems, and an objective thereof is to provide a Jacobian groupelement adder that enables the additive algorithm in the Jacobian groupof the c_(ab) curve to be executed at a high speed.

[0007] The Jacobian group element adder in accordance with the presentinvention, which is an arithmetic unit for executing addition in aJacobian group of an algebraic curve defined by a polynomial definedover a finite field that is

Y3+α₀X⁴+α₁XY²+α₂X²Y+α₃X³+α₄Y²+α₅XY+α₆X²+α₇Y+α₈X+α₉

[0008] or

Y²+α₀X⁵+α₁X²Y+α₂X⁴+α₃XY+α₄X³+α₅Y+α₆X²+α₇X+α₈

[0009] or

Y²+α₀X⁷+α₁X³Y+α₂X⁶+α₃X²Y+α₄X⁵+α₅XY+α₆X⁴+α₇Y+α₈X³+α₉X²+α₁₀X+α₁₁,

[0010] is characterized in comprising:

[0011] means for inputting an algebraic curve parameter file having anorder of a field of definition, a monomial order, and a coefficient listdescribed as a parameter representing said algebraic curve;

[0012] means for inputting Groebner bases I₁ and I₂ of ideals of thecoordinate ring of the algebraic curve designated by said algebraiccurve parameter file, which represent elements of said Jacobian group;

[0013] ideal composition means for, in the coordinate ring of thealgebraic curve designated by said algebraic curve parameter file,performing arithmetic of a producing Groebner basis J of the ideal whichis a product of the ideal that the Groebner basis I₁ generates, and theideal that the Groebner basis I₂ generates;

[0014] first ideal reduction means for, in the coordinate ring of thealgebraic curve designated by said algebraic curve parameter file,performing arithmetic of producing a Groebner basis J* of the ideal,which is smallest in the monomial order designated by said algebraiccurve parameter file among the ideals equivalent to an inverse ideal ofthe ideal that the Groebner basis J generates; and

[0015] second ideal reduction means for, in the coordinate ring of thealgebraic curve designated by said algebraic curve parameter file,performing arithmetic of producing a Groebner basis J** of the ideal,which is smallest in the monomial order designated by said algebraiccurve parameter file among the ideals equivalent to an inverse ideal ofthe ideal that the Groebner basis J* generates to output it.

[0016] [C_(ab) Curve and its Jacobian Group]

[0017] The C_(ab) curve C to be treated in the present invention is anonsingular plane curve to be defined by a polynomial F(X,Y) having thefollowing formula for two natural numbers a and b that are relativelyprime.

F(X,Y)=Y ^(a) +c ₀ X ^(b) +Σc _(i,j) X ^(i) Y ^(j)

[0018] Here, indexes i and j in the above equation, which are naturalnumbers equal to or more than zero, vary in a range of ai+bj<ab. Also,suppose that c₀ and c_(i,j) are elements of a defining field k, and thatc₀ is not zero. The C_(ab) curve C has a unique point at infinity P_(∞),and the polynomials Y and X have a unique b-order pole and a-order poleat P_(∞) respectively. Set a group subtended by divisors of degree 0 onthe C_(ab) curve C to D_(c) ⁰(k), and set a group composed of principaldivisors to P_(c)(k).

[0019] A Jacobian group J_(c)(k) of which the additive algorithm isrequired to be found in the present invention is defined as

J _(c)(k)=D _(c) ⁰(k)/P _(c)(k)

[0020] On the other hand, let R=k[X,Y]/F be the coordinate ring of theC_(ab) curve C, it follows that the ring R becomes an integrally-closedintegral domain, which is a Dedekind domain, because the C_(ab) curve Cis nonsingular by definition. Thus, all of the fractional ideals of thering R that is not zero compose a group I_(R)(k). Set a subgroup bysubtended by the principal ideal of the ring R to P_(R)(k), then anideals class group H_(R)(k) of the ring R is defined as

H _(R)(k)=I _(R)(k)/P _(R)(k)

[0021] As a rule, it is known that, for the nonsingular algebraic curve,the divisor on the curve can be identified with the ideal of thecoordinate ring, and that its Jacobian group and the ideal class groupare of intrinsic isomorphism. In particular, a Jacobian group J_(C)(k)of the C_(ab) curve C and the ideal class group H_(R)(k) of thecoordinate ring R are of intrinsic isomorphism. The ideal is moreconvenient than the divisor for packaging algorithm, whereby,hereinafter, the Jacobian group J_(C)(k) of the C_(ab) curve C istreated as the ideal class group H_(R)(k) of the coordinate ring R.

[0022] [Preparation Relating to a Groebner Basis]

[0023] Since the Groebner basis of the ideal is employed in calculationof which an object is the ideal class group H_(R)(k), a preparationrelating hereto is made in this chapter. As a rule, for a polynomialring S=k[X₁, . . . ,X_(n)], an order ‘<’ among its monomials, if it iscompatible with a product, that is, M₁<M₂ always yields M1M3, is calleda monomial order. In this chapter, from now on, suppose an arbitrarymonomial order ‘<’ is given to a polynomial ring S.

[0024] For a polynomial f in S, call the largest monomial in themonomial order ‘<’ that appears in f a leading monomial of f, which isdenoted by LM(f). Also, for an ideal I, LM(I) denotes an ideal that isgenerated by leading monomials of the polynomial belonging to Igenerates by LM(I).

[0025] For an ideal I=(f₁, . . . ,f_(s)) of S that is generated by apolynomials f₁, . . . ,f_(s), when {f₁, . . . ,f_(s)} meetsIM(I)=(LM(f₁), . . . ,LM(f_(s))), {f₁, . . . ,f_(s)} is called aGroebner basis of the ideal I. For the ideal I of the polynomial ring S,the entirety Δ(I) of the monomial (or its multi degree) Δ(I) that doesnot belong to LM(I) is called a delta set of I. When (multi degrees of)monomials in Δ(I) are plotted, a convex set appears, and a lattice pointencircling its convex set corresponds to the leading monomial of anelement of the Groebner basis of I. Also, Δ(I) subtends the basis of avector space S/I over k.

[0026] The ideal I of an the coordinate ring R=S/F of a nonsingularaffine algebraic curve C can be identified with the ideal of thepolynomial ring S that includes a defining ideal F of the curve C. Thus,for the ideal of the coordinate ring R as well, as mentioned above,Groebner basis can be considered. For a zero-dimensional ideal I (thatis, a set of zeros of I is a finite set) of the coordinate ring R=S/F,call a dimension of a vector space S/I over k an order of the ideal I,which is denoted by δ(I). Immediately from definition, it can be seenthat δ(I) is equivalent to the order of the set Δ(I). Also, byassumption of being nonsingular, it follows that δ(IJ)=δ(I)δ(J). WhenI=(f) is a principal ideal of R, then δ(I)=−v_(P∞)(f), where v_(P∞)(f)represents a valuation of the polynomial f at P_(∞).

[0027] [Additive Algorithm on Jacobian Group of C_(ab) Curve, part 1]

[0028] Now think about the coordinate ring R=k[X,Y]/F of the C_(ab)curve C defined by the polynomial F(X,Y). Regard the monomial of twovariables X^(m)Y^(n) as a function on the curve C, and call the monomialorder obtained by ordering the monomials based on the size of a poleorder-v_(P∞)(X^(m)Y^(n)) at P_(∞)a C_(ab) order. Here, in the case thatthe pole orders at P_(∞) thereof are the same, the monomial with thelarger is supposed to be larger. Hereinafter, the C_(ab) order isemployed as the monomial order of the coordinate ring R of the C_(ab)curve C. For the ideal I of the coordinate ring R, let f_(I) be thenon-zero polynomial with the smallest leading monomial among thepolynomials in I. Furthermore, let I*=(f_(I)):I(={g∈R|g·I⊂(f_(I))}).

[0029] Now, it can be easily shown that, when I and J are arbitrary(integral) ideals of the coordinate ring R, then (1) I and I** arelinearly equivalent, (2) I**, which is an (integral) ideal equivalent toI, has the smallest order among ideals equivalent to I, and (3) if I andJ are equivalent, then I*=J*, in particular, J**=(I**)**. For an ideal Iof the coordinate ring R, when I**=(I), we call I a reduced ideal. Fromthe above-mentioned equations (1) and (3), an arbitrary ideal isequivalent to the unique reduced ideal. That is, the reduced idealscompose a representative system of the ideal classes. This property isnot limited to the Caborder, and holds also in the event of havingemployed an arbitrary monomial order; however, in the event of havingemployed the C_(ab) order, from the above-mentioned equation (2), thereduced ideal has the property of becoming an ideal of which the orderis the smallest among the equivalent ideals. This is advantageous inpackaging the algorithm. Using reduced ideal as a representative systemof the ideal classes, we obtain additive algorithm on Jacobian of C_(ab)curve, mentioned below.

[0030] [Additive Algorithm on Jacobian Group 1]

[0031] Inputs: reduced ideals I₁ and I₂ of the coordinate ring R

[0032] Output: a reduced ideal I₃ equivalent to an ideal product I₁·I₂

[0033] 1. J→I₁·I₂

[0034] 2. J*→(f_(J)):J

[0035] 3. I₃→(f_(J)*):J*

[0036] [Classification of Ideals]

[0037] So as to realize the above-mentioned additive algorithm onJacobian group 1 as a program that is efficient, and yet is easy topackage, the ideals that appear during execution of the additivealgorithm 1 are classified. Hereinafter, for simplification, explanationis made with a C₃₄ curve (that is, the C_(ab) curve with a=3, and b=4)taken as an object; however, for the general C_(ab) curve as well, thematter is similar. A genus of the C₃₄ curve is 3, whereby the order ofthe ideal that appears during execution of the additive algorithm 1 isequal to or less than 6. The Groebner bases in their C₃₄ orders areclassified as follows order by order. However, from now on, even thougha defining equation F of the C₃₄ curve C appears in the Groebner basisof the ideal, F is omitted, and is not expressed. Also, coefficientsa_(i), b_(j), and c_(k) of each polynomial constructing the Groebnerbasis are all elements of k.

[0038] (Ideal of Order 6)

[0039] Suppose I is an ideal of order 6 of the coordinate ring R. Bydefinition of the order, V=R/I is a six-dimensional vector space overthe defining field k. When six points that the ideal I represents are ata “generalized” position, six monomials from the beginning in the C₃₄order 1, X, Y, X², XY, and Y² are linearly independent at these sixpoints. That is, the monomials 1, X, Y, X², XY, and Y² compose a basisof the vector space V. At this time, we call such an ideal I an ideal ofa type 61.

[0040] As a rule, a delta set Δ(I) of the ideal I can be identified withthe basis of the vector space V, whereby the delta set of the ideal I ofa type 61 becomes Δ(I)={(0,0), (1,0), (0,1), (2,0), (1,1), (0,2)} Thelattice points encircling these are (0,3), (1,2), (2,1), (3,0)} . Thus,the Groebner basis of the ideal I of a type 61 takes the following form.

[0041] The Groebner basis of the ideal of a type61={X³+a₆Y²+a₅XY+a₄X²+a₃Y+a₂X+a₁, X²Y+b₆Y²+b₅XY+b₄X²+b₄X²+b₃Y+b₂X+b₁,XY²+c₆Y²+c₅XY+c₄X²+c₃Y+c₂X+c₁}

[0042] These three polynomials correspond to the lattice points (3,0),(2,1), and (1,2) respectively (The lattice point (0,3) corresponds tothe defining equation F). As a rule, six monomials 1, X, Y, X², XY, andY² are not always linearly independent at the six points that the idealI represents, i.e. in the vector space V.

[0043] So, next, we study the case in which five monomials from thebeginning in the C₃₄ order 1, X, Y, X², and XY are linearly independentin V, and the sixth monomial Y² is represented by a linear combinationof them. By assumption, Δ(I) is a convex set of order 6 that includes{(0,0), (1,0), (0,1), (2,0), (1,1)}, and does not include (2,0). Thus,it becomes either of Δ(I)={(0,0), (1,0), (0,1), (2,0), (1,1), (2,1)}, orΔ(I)={(0,0), (1,0), (0,1), (2,0), (1,1), (3,0)}. When Δ(I) is theformer, call I an ideal of a type 62, and in the event that it is thelatter, call I an ideal of type 63.

[0044] The lattice point set encircling Δ(I) is {(0,2), (3,0)} when I isof type 62, and is (0,2),(2,1),(4,0)} when I is of type 63. Thus, theGroebner basis becomes the following. The Groebner basis of the ideal ofa type 62={Y²+a₅XY+a₄X²+a₃Y+a₂X+a₁, X³+b₅XY+b₄X²+b₃Y+b₂X+b₁}

[0045] These two polynomials correspond to the lattice points (0,2), and(3,0) respectively.

[0046] The Groebner basis of the ideal of a type63={Y²+a₅XY+a₄X²+a₃Y+a₂X+a₁, X²Y+b₆X³+b₅XY+b₄X²+b₃Y+b₂X+b₁}

[0047] These two polynomials correspond to the lattice points (0,2), and(2,1) respectively.

[0048] Although the polynomial, which corresponds to the lattice point(4,0), originally exists in the Groebner basis of the ideal of a type63; it was omitted since from the defining equation F, and an equationf=Y²+a₅XY+a₄X²+a₃Y+a₂X+a₁ that corresponds to the lattice point (0,2),it can be immediately calculated as F−Yf.

[0049] Next, suppose four monomials from the beginning 1, X, Y, and X²are linearly independent in V, and that the fifth monomial XY isrepresented by a linear combination thereof. That is, Δ(I) includes{(0,0), (1,0), (0,1), (2,0)}, and does not include (1,1).Here, assumeΔ(I) does not includes (0,2), then there is no other choice butΔ(I)=(0,0), (1,0), (0,1), (2,0),(3,0), (4,0)} so that Δ(I) has order 6.As it is, by assumption, I includes a polynomial f=Y²+. . . of which theleading term is Y². As a result, (4,0) does not belong to Δ(I) becauseYf−F=X⁴+. . . belongs to I. That is contradictory. From the foregoing,it can be seen that Δ(I) is sure to include (0,2), then Δ(I)={(0,0),(1,0), (0,1), (2,0), (0,2), (3,0)}. At this time, call I an ideal of atype 64.

[0050] The lattice point set encircling the delta set Δ(I) of the idealI of a type 64 is {(0,3), (1,1), (4,0)}. Thus the Groebner basis of theideal I of a type 64 becomes the following.

[0051] The Groebner basis of the ideal of a type 64={XY+a₄X²+a₃Y+a₂X+a₁,X⁴+b₆X³+b₅Y²+b₄X²+b₃Y+b₂X+b₁}

[0052] These two equations correspond to the lattice points (1,1), and(4,0) respectively (The lattice point (0,3) corresponds to the definingequation F).

[0053] Next, suppose three monomials from the beginning 1, X, and Y inthe C₃₄ order are linearly independent in V=R/I, and that the fourthmonomial X² is represented by a linear combination thereof. At thistime, since a polynomial f of which the leading term is X² is includedin the ideal I, the delta set becomes Δ(I)={(0,0), (1,0), (0,1), (1,1),(0,2), (1,2)}and the lattice point set encircling these becomes{(0,3),(2,0)}, whereby I becomes a monomial ideal to be generated in f.At this time, call I an ideal of a type 65.

[0054] The Groebner basis of the ideal of a type 65={X²+a₃Y+a₂X+a₁}

[0055] The above equation corresponds to the lattice point (2,0) (Thelattice point (0,3) corresponds to the defining equation F)

[0056] There is no possibility that, from deg((f)₀)=−v_(P∞)(f)=4<6, thepolynomial f of which the leading term is (a term equal to or lowerthan) Y disappears simultaneously at six points that correspond to theideal I of order 6. Thus, three monomials 1, X, and Y from the beginningare always linearly independent in V=R/I, and above, the classificationof the ideal of order 6 was completed.

[0057] (Ideal of Order 5)

[0058] Suppose I is an ideal of order 5 of coordinate ring R. The idealof order 5 is also classified into a type 51 to a type 54 similarly tothe ideal of order 6, as mentioned below.

[0059] The Groebner basis of the ideal of a type51={Y²+a₅XY+a₄X²+a₃Y+a₂X+a₁, X³+b₅XY+b₄X²+b₃Y+b₂X+b₁,X²Y+c₅XY+c₄X²+c₃Y+c₂X+c₁}

[0060] The Groebner basis of the ideal of a type 52={XY+a₄X²+a₃Y+a₂X+a₁,Y²+b₄X²+b₃Y+b₂X+b₁}

[0061] The Groebner basis of the ideal of a type 53={XY+a₄X²+a₃Y+a₂X+a₁,X³+b₅Y²+b₄X²+b₃Y+b₂X+b₁}

[0062] The Groebner basis of the ideal of a type 54={X²+a₃Y+a₂X+a₁,XY²+b₅Y²+b₄XY+b₃Y+b₂X+b₁}

[0063] (Ideal of Order 4)

[0064] The ideal I of order 4 is also classified into a type 41 to atype 44 similarly, as mentioned below.

[0065] The Groebner basis of the ideal of a type 41={XY+a₄X²+a₃Y+a₂X+a₁,Y²+b₄X²+b₃Y+b₂X+b₁, X³+c₄X²+c₃Y+c₂X+c₁}

[0066] The Groebner basis of the ideal of a type 42={X²+a₃Y+a₂X+a₁,XY+b₃Y+b₂X+b₁}

[0067] The Groebner basis of the ideal of a type 43={X²+a₃Y+a₂X+a₁,Y²+b₄XY+b₃Y+b₂X+b₁}

[0068] The Groebner basis of the ideal of a type 44={Y+a₂X+a₁}

[0069] (Ideal of Order 3)

[0070] The ideal I of order 3 is also classified into a type 31 to atype 33 similarly, as mentioned below.

[0071] The Groebner basis of the ideal of a type 31={X²+a₃Y+a₂X+a₁,XY+b₃Y+b₂X+b₁, Y²+c₃Y+c₂X+c₁}

[0072] The Groebner basis of the ideal of a type 32={Y+a₂X+a₁,X³+b₃X²+b₂X+b₁}

[0073] The Groebner basis of the ideal of a type 33={X+a₁}

[0074] (Ideal of Order 2)

[0075] The ideal I of order 2 is also classified into a type 21 and atype 22 similarly, as mentioned below.

[0076] The Groebner basis of the ideal of a type 21={Y+a₂X+a₁,X²+b₂X+b₁}

[0077] The Groebner basis of the ideal of a type 22={X+a₁, Y²+b₂Y+b₁}

[0078] (Ideal of Order 1)

[0079] Needless to say, the ideal of order 1 is only of type 11, asmentioned below.

[0080] The Groebner basis of the ideal of a type 11={X+a₁, Y+b₁}

[0081] [Remark]

[0082] Ideals of a type 65, 44, and 33 among the ideals mentioned above,which are a principal ideal, represent a unit element as a Jacobiangroup element. Also, the reduced ideal types among the ideal typesmentioned above are only 31, 21, 22, and 11. For example, the reason whythe ideal of a type 32 is not a reduced one is understood in a mannermentioned below.

[0083] Suppose I is an ideal of a type 32, then f_(I)=Y+a₂X+a₁, thusδ(I*)=−v_(∞)(f_(I))−δ(I)=4−3=1, thus, f_(I*)=X+a′, andδ(I**)=−v_(∞)(f_(I*))−δ(I*)=3−1=2 because I* is of type 11. The orderthereof is different, whereby I≠I**.

[0084] [Additive Algorithm on Jacobian Group of the C₃₄ curve, Part 2]

[0085] Set the coordinate ring of the C₃₄ curve C defined over a field khaving the defining equation F to R=k[X,Y]/F. Now let the additivealgorithm 1 take concrete shape more clearly for estimating itsexecution speed. However, hereinafter, the order of the field k issupposed to be sufficiently large in consideration of an application tothe discrete logarithmic cryptography.

[0086] (Composition Operation 1)

[0087] At first, study a first step of the additive algorithm 1 fordifferent ideals I₁ and I₂, which is hereinafter referred to as acomposition operation 1. That is, f_(J) is to be found for an idealproduct J=I₁·I₂. To this end, the Groebner basis of the ideal product Jshould be found (since f_(J) is its first element). The genus of the C₃₄curve is 3, whereby the order of the ideal I1 or I2 is equal to or lessthan 3. Thus, its type is anyone of 11, 21, 22, 31, and 32. The case ismentioned here in which both of the ideals I₁ and I₂ are of type 31;however the other case is also similar.

[0088] We can Suppose I₁ and I₂ are selected at random from the Jacobiangroup, Then we have at almost every case,

V(I ₁)∩I(I ₂)=φ  (1)

[0089] Because the order of the field k is supposed to be sufficientlylarge. Here for the ideal I, a set of zero of I is denoted by V(I) (φrepresents an empty set). Also in the event that the condition (1) isnot met, upon generating element R₁ and R₂ that yields R₁+R₂=0, andcalculating (I₁+R₁)+(I₂+R₂) instead of (I₁+I₂), then it boils down tothe case in which the condition (1) holds. Also, the case is very rare(a probability of 1/q or something like it when the size of the definingfield k is taken as q) in which the condition (1) is not met, wherebyonly the case in which the condition (1) is met should be considered inevaluating efficiency of the algorithm. Thereupon, hereinafter, assumethat I₁ and I₂ meet the condition (1).

[0090] Suppose J=I1I₂ is a product of I₁ and I₂ in R. I₁ and I₂ are bothideals of order 3, whereby the order of J becomes 6. Thus, the type of Jis anyone of 61, 62, 63, 64, and 65. So as to decide which the type of Jis, a linear relation should be found in a residue ring R/J among tenmonomials 1, X, Y, X², XY, Y², X³, X²Y, XY² and X⁴ (2)

[0091] An ideal I_(i)(i=1,2) is of type 31, whereby $\begin{matrix}{{{R/I_{i}} \cong {{k \cdot 1} \oplus {k \cdot X} \oplus {k \cdot Y}}}\left. m\quad\mapsto\quad v_{m}^{i} \right.} & \left\lbrack {{EQ}.\quad 1} \right\rbrack\end{matrix}$

[0092] From the condition (1), it follows that $\begin{matrix}{{{R/J} \cong {{R/I_{1}} \oplus {R/I_{2}}} \cong {\oplus_{i = 1}^{6}k}}\left. m\mapsto\left( {{m\quad {{mod}\left( I_{i} \right)}},{{mmod}\left( I_{2} \right)}} \right)\mapsto{v_{m}^{(1)}:v_{m}^{(2)}} \right.} & \left\lbrack {{EQ}.\quad 2} \right\rbrack\end{matrix}$

[0093] where v⁽¹⁾ _(m):v⁽²⁾ _(m) is a six-dimensional vector over k tobe obtained by connecting two vectors v^((i)) _(m)(i=1,2). Thus, so asto find a linear relation in R/J among ten monomials m_(i) in theequation (2), an intra-row linear relation of the following 10×6 matrixM_(c) should be found with vectors v⁽¹⁾ _(mi):v⁽²⁾ _(mi)(i=1, 2, . . . ,10) taken as a row. $\begin{matrix}{M_{C} = \begin{pmatrix}{v_{1}^{(1)}:v_{1}^{(2)}} \\{v_{X}^{(1)}:v_{X}^{(2)}} \\{v_{Y}^{(1)}:v_{Y}^{(2)}} \\{v_{X^{2}}^{(1)}:v_{X^{2}}^{(2)}} \\{v_{XY}^{(1)}:v_{XY}^{(2)}} \\{v_{Y^{2}}^{(1)}:v_{Y^{2}}^{(2)}} \\{v_{X^{3}}^{(1)}:v_{X^{3}}^{(2)}} \\{v_{X^{2}Y}^{(1)}:v_{X^{2}Y}^{(2)}} \\{v_{X\quad Y^{2}}^{(1)}:v_{X\quad Y^{2}}^{(2)}} \\{v_{X^{4}}^{(1)}:v_{X^{4}}^{(2)}}\end{pmatrix}} & \left\lbrack {{EQ}.\quad 3} \right\rbrack\end{matrix}$

[0094] As well known, the intra-row linear relation of the matrix M_(c)is obtained by triangulating a matrix M_(c) with row-reducingtransformation, and this allows a type of the ideal J and its Groebnerbasis to be obtained. The details will be described in embodiments.

[0095] (Remark)

[0096] In the event that the condition (1) does not hold for the idealsI₁ and I₂, the rank of the matrix M_(c) becomes equal to or less than 5.In calculating the ideal product of I₁ and I₂, at first, assume thatthey meet the condition (1) for calculation, and as a result of therow-reducing transformation, if it becomes clear that the rank of thematrix M_(c) is equal to or less than 5, then the elements R₁ and R₂that yields R₁+R₂=0 should be generated to calculate (I₁+R₁)+(I₂+R₂)instead of I₁+I₂.

[0097] (Composition Operation 2)

[0098] Now study a first step of the additive algorithm 1 for the sameideals I₁=I, and I₂=I of the coordinate ring R=k[X,Y]/F, which ishereinafter referred to as a composition operation 2. That is, for anideal product J=I 2, its Groebner basis is to be found for calculationof f_(J). The case is mentioned in which the ideal I is of type 31;however the other case is also similar. The order of the field k issupposed to be sufficiently large, whereby no multiple point exists inV(I) in almost every case. (3)

[0099] Also, in evaluating efficiency of the algorithm, only the caseshould be considered in which the condition (3) is met. Hereinafter,assume that I meets the condition (3). J=I² is still an ideal of order6, whereby, so as to calculate its Groebner basis, a linear relationshould be found in the residue ring R/J among the monomials of theequation (1). The ideal I is of type 31, whereby $\begin{matrix}{{{R/I_{i}} \cong {{k \cdot 1} \oplus {k \cdot X} \oplus {k \cdot Y}}}\left. m\quad\mapsto\quad v_{m} \right.} & \left\lbrack {{EQ}.\quad 4} \right\rbrack\end{matrix}$

[0100] Also, from the condition (3), the necessary and sufficientcondition for causing the polynomial f(∈R) to belong to J=I₂ is

f∈I,f_(X)F_(Y)−f_(Y)F_(X)∈I

[0101] (Here, for the polynomial f, f_(X) denotes a differential of fwith regard to X. As to f_(Y) as well, the matter is similar.) Thus,$\begin{matrix}{{{R/J} \cong {{R/I} \oplus {R/I}} \cong {\oplus_{i = 1}^{6}k}}\left. m\mapsto\left( {{m\quad {{mod}(I)}},{{m_{X}F_{Y}} - {m_{Y}F_{X}{{mod}(I)}}}} \right)\mapsto{v_{m}:v_{({{m_{X}F_{Y}} - {m_{Y}F_{X}}})}} \right.} & \left\lbrack {{EQ}.\quad 5} \right\rbrack\end{matrix}$

[0102] Where, v_(m):v_((mX FY−mY FX)) is a six-dimensional vector over kto be obtained by connecting two vectors v_(m) and v_((mX FY−mY FX)).After all, so as to find the above-mentioned linear relation, for tenmonomials m_(i) in the equation (1), a intra-row linear relation shouldbe found of the following 10×6 matrix MD mentioned below with asix-dimensional vector v_(mi):v_((miX FY−miY FX)) over k taken as a row.$\begin{matrix}{M_{C} = \begin{pmatrix}{v_{1}:0} \\{v_{X}:v_{(F_{Y})}} \\{v_{Y}:v_{({- F_{X}})}} \\{v_{X^{2}}:v_{({2\quad F_{Y}X})}} \\{v_{X\quad Y}:v_{({{{- F_{X}}X} + {F_{Y}Y}})}} \\{v_{Y^{2}}:v_{({{- 2}F_{X}Y})}} \\{v_{X^{3}}:v_{({3F_{Y}X^{2}})}} \\{v_{X^{2}Y}:v_{({{{- F_{X}}X^{2}} + {2F_{Y}X\quad Y}})}} \\{v_{X\quad Y^{2}}:v_{({{{- 2}F_{X}X\quad Y} + {F_{Y}Y^{2}}})}} \\{v_{X^{4}}:v_{({4F_{Y}X^{3}})}}\end{pmatrix}} & \left\lbrack {{EQ}.\quad 6} \right\rbrack\end{matrix}$

[0103] From now on, upon triangulating the matrix M_(D) with therow-reducing transformation, the type of the ideal J and its Groebnerbasis can be obtained similarly to the composition operation 1.

[0104] (Remark)

[0105] In the event that the condition (3) does not hold for the idealI, the rank of the matrix M_(D) becomes equal to or less than 5. Incalculating the Groebner basis of I², at first, assume that it meets thecondition (3) for calculation, and as a result of the row-reducingtransformation, if it becomes clear that the rank of the matrix M_(D) isequal to or less than 5, then elements R₁ and R₂ that yields R₁+R₂=0should be generated to calculate (I+R₁)+(I+R₂) instead of I+I.

[0106] (Reduction Operation)

[0107] Now study a second step (and a third step) of the additivealgorithm 1, which is hereinafter referred to as a reduction operation.That is, for the ideal J of which the order is equal to or less than 6,the Groebner basis of J*=f_(J):J is to be found. The case is mentionedbelow in which J is of type 61; however the other case is also similar.

[0108] J is of type 61, whereby its Groebner basis can be expressed by{f_(J)=X³+a₆Y²+. . . , g=X²Y+b₆Y²+. . . , h=XY²+c₆Y²+. . . }

[0109] By definition, J*=f_(J):J, whereby δ(J*)=−v_(∞)(f_(J))−δ(J)=3.Thus, it can be seen that J* becomes an ideal of a type 31 because J* isa reduced ideal. Thus so as to find its Groebner basis, for the monomialm_(i) in

1, X, Y, X², XY, and Y²   (4)

[0110] a linear relation Σ_(i)d_(i)m_(i) should be found in whichΣ_(i)d_(i)m_(i)g and Σ_(i)d_(i)m_(i)h become zero simultaneously inR/f_(J).

[0111] From LM(F)=Y³,LM(f_(J))=X³, then $\begin{matrix}{{{{R/f_{J}}R} \cong {{k \cdot 1} \oplus {k \cdot X} \oplus {k \cdot Y} \oplus {k \cdot X^{2}} \oplus {{k \cdot X}\quad Y} \oplus {k \cdot Y^{2}} \oplus {{k \cdot X^{2}}Y} \oplus {{k \cdot X}\quad Y^{2}} \oplus {{k \cdot X^{2}}\quad Y^{2}}}}\left. f\quad\mapsto\quad w_{j} \right.} & \left\lbrack {{EQ}.\quad 7} \right\rbrack\end{matrix}$

[0112] whereby, so as to find the above-mentioned linear relation, foreach of six monomials m_(i) in the equation (4), an intra-row linearrelation should be found of the following 6×18 matrix M_(R) with a18-dimensional vector w_((mi g)):w_((mi h)) over k to be obtained byconnecting two vectors w_((mi g)) and w_((mi h)) taken as a row.$\begin{matrix}{M_{R} = \begin{pmatrix}{w_{g}:w_{h}} \\{w_{X\quad g}:w_{X\quad h}} \\{w_{Y\quad g}:w_{Y\quad h}} \\{w_{X^{2}g}:w_{X^{2}h}} \\{w_{X\quad Y_{g}}:w_{X\quad Y\quad h}} \\{w_{Y^{2}g}:w_{Y^{2}h}}\end{pmatrix}} & \left\lbrack {{EQ}.\quad 8} \right\rbrack\end{matrix}$

[0113] From now on, upon triangulating the matrix M_(R) with therow-reducing transformation, the Groebner basis of the ideal J* can beobtained. However, as matter of fact, in almost every case, it is enoughto triangulate not the matrix M_(R) itself but a certain submatrix M_(r)of its 6×3. This will be described in details in the next chapter.

[0114] (Arithmetic Quantity of Algorithm)

[0115] An arithmetic quantity of the algorithm will be evaluated. Setthe order of the defining field to q, then a random element of theJacobian group is represented by the ideal of a type 31 apart from anexception of a probability of 1/q. Also, the result of the compositionoperations 1 and 2 for the ideal of a type 31 demonstrates that itbecomes an ideal of a type 61 apart from an exception of a probabilityof 1/q. Thus, so as to evaluate the arithmetic quantity of thealgorithm, the arithmetic quantity of the composition operations 1 and 2at the time of having input the ideal of a type 31, and the arithmeticquantity of the reduction operation at the time of having input theideal of a type 61 or a type 31 should be evaluated. Also, thearithmetic quantity of the algorithm is represented below with thenumber of the times of multiplication and reciprocal arithmetic.

[0116] At first, the arithmetic quantity of the composition operation 1is examined. Suppose that I₁ and I₂ are ideals of type 31: then

[0117] I₁={X²+a₃Y+a₂X+a₁, XY+b₃Y+b₂X+b₁, Y²+c₃Y+c₂X+c₁}

[0118] I₂={X²+s₃Y+s₂X+s₁, XY+t₃Y+t₂X+t₁, Y²+u₃Y+u₂X+u₁}

[0119] For the ideals I₁ and I₂, the matrix M_(c) is expressed by$\begin{matrix}{M_{C} = \begin{pmatrix}1 & 0 & 0 & 1 & 0 & 0 \\0 & 1 & 0 & 0 & 1 & 0 \\0 & 0 & 1 & 0 & 0 & 1 \\{- a_{1}} & {- a_{2}} & {- a_{3}} & {- s_{1}} & {- s_{2}} & {- s_{3}} \\{- b_{1}} & {- b_{2}} & {- b_{3}} & {- t_{1}} & {- t_{2}} & {- t_{3}} \\{- c_{1}} & {- c_{2}} & {- c_{3}} & {- u_{1}} & {- u_{2}} & {- u_{3}} \\{{a_{1}a_{2}} + {a_{3}b_{1}}} & {{- a_{1}} + a_{2}^{2} + {a_{3}b_{2}}} & {{a_{2}a_{3}} + {a_{3}b_{3}}} & {{s_{1}s_{2}} + {s_{3}t_{1}}} & {{- s_{1}} + s_{2}^{2} + {s_{3}t_{2}}} & {{s_{2}s_{3}} + {s_{3}t_{3}}} \\{{a_{2}b_{1}} + {a_{3}c_{1}}} & {{a_{2}b_{2}} + {a_{3}c_{2}}} & {{- a_{1}} + {a_{2}b_{3}} + {a_{3}c_{3}}} & {{s_{2}t_{1}} + {s_{3}u_{1}}} & {{s_{2}t_{2}} + {s_{3}u_{2}}} & {{- s_{1}} + {s_{2}t_{3}} + {s_{3}u_{3}}} \\{{b_{1}b_{2}} + {b_{3}c_{1}}} & {b_{2}^{2} + {b_{3}c_{2}}} & {{- b_{1}} + {b_{2}b_{3}} + {b_{3}c_{3}}} & {{t_{1}t_{2}} + {t_{3}u_{1}}} & {t_{2}^{2} + {t_{3}u_{2}}} & {{- t_{1}} + {t_{2}t_{3}} + {t_{3}u_{3}}} \\e_{10,1} & e_{10,2} & e_{10,3} & e_{10,4} & e_{10,5} & e_{10,6}\end{pmatrix}} & \left\lbrack {{EQ}.\quad 9} \right\rbrack\end{matrix}$

[0120] where,

[0121] e_(10,1)=a₁ ²−a₁a₂ ²−2a₂a₃b₁−a₃ ²c₁

[0122] e_(10,2)=2a₁a₂−a₂ ³−2a₂a₃b₂−a₃ ²c₂

[0123] e_(10,3)=2a₁a₃−a₂ ²a₃−2a₂a₃b₃−a₃ ²c₃

[0124] e_(10,4)=s₁ ²−s₁s₂ ²−2s₂s₃t₁−s₃ ²u₁

[0125] e_(10,5)=2s₁s₂−s₂ ³−2s₂s₃t₂−s₃ ²u₂

[0126] e_(10,6)=2s₁s₃−s₂ ²s₃−2s₂s₃t₃−s₃ ²u₃

[0127] From this, it can be seen that upon eliminating multiplicitysuccessfully, the matrix M_(c) can be constructed with at most 44-timesmultiplication.

[0128] Upon paying attention to the fact that the row-reductiontransformation for the matrix M_(c)′ takes a formula having the firstrow to the third row thereof already row-reduction, and that itscomponent is 0 or 1, it can be executed with three-times division and atmost 6×6+6×5+6×4=90-times multiplication. From the foregoing, thearithmetic quantity of the composition operation 1 is at mostthree-times reciprocal arithmetic, and 134-times multiplication.Similarly, it can be seen that the arithmetic quantity of thecomposition operation 2 is at most three-times reciprocal arithmetic,and 214-times multiplication. The arithmetic quantity is increased bythe extent to which the matrix M_(D) is more complex than M_(c).

[0129] Next, the arithmetic quantity of the reduction operation at thetime of having input the ideal of a type 61 is examined. Suppose J is anideal of type 61: then J={X³+a₆Y²+a₅XY+a₄X²+a₃Y+a₂X+a₁,X²Y+b₆Y²+b₅XY+b₄X²+b₃Y+b₂x+b₁, XY²+c₆Y²+c₅XY+c₄X²+c₃Y+c₂X+c₁}

[0130] A 6×3 minor M_(r) obtained by taking a seventh column to a ninthcolumn of the matrix M_(R) for the ideal J becomes $\begin{matrix}{M_{r} = \begin{pmatrix}1 & 0 & 0 \\{{- a_{4}} - {a_{5}a_{6}} + b_{5}} & {{- a_{5}} - a_{6}^{2} + b_{6}} & 0 \\{b_{4} + {a_{5}b_{6}}} & {b_{5} + {a_{6}b_{6}}} & 1 \\e_{4,1} & e_{4,2} & {{- a_{5}} - a_{6}^{2} + b_{6}} \\e_{5,1} & e_{5,2} & {{- a_{4}} - {2a_{5}a_{6}} - a_{6}^{3} + b_{5} + {a_{6}b_{6}}} \\e_{6,1} & e_{6,2} & e_{6,3}\end{pmatrix}} & \left\lbrack {{EQ}.\quad 10} \right\rbrack\end{matrix}$

[0131] wheree_(4, 1) = −a₂ + a₄² − a₃a₆ + 3a₄a₅a₆ + a₅²a₆² + b₃ − a₅b₄ − a₄b₅ − a₅a₆b₅e_(4, 2) = −a₃ + a₄a₅ + a₅²a₆ + 2a₄a₆² + a₅a₆³ − a₆b₄ − a₅b₅ − a₆²b₅e_(5, 1) = −2a₃a₅ + 2a₄a₅² − a₂a₆ + a₄²a₆ + a₅³a₆ − a₃a₆² + 3a₄a₅a₆² + a₅²a₆³ + b₂ − a₄b₄ − a₅a₆b₄ + a₃b₆ − 2a₄a₅b₆ − a₅²a₆b₆e_(5, 2) = −a₂ + a₅³ − 2a₃a₆ + 2a₄a₅a₆ + 2a₅²a₆² + 2a₄a₆³ + a₅a₆⁴ + b₃ − a₅b₄ − a₆²b₄ − a₅²b₆ − a₄a₆b₆ − a₅a₆²b₆e_(6, 1) = −2a₃a₄ − 2a₂a₅ + 3a₄²a₅ − 4a₃a₅a₆ + 6a₄a₅²a₆ − a₂a₆² + a₄²a₆² + 2a₅³a₆² − a₃a₆³ + 3a₄a₅a₆³ + a₅²a₆⁴ + a₅b₃ + a₃b₅ − 2a₄a₅b₅ − a₅²a₆b₅ + a₂b₆ − a₄²b₆ + a₃a₆b₆ − 3a₄a₅a₆b₆ − a₅²a₆²b₆e_(6, 2) = −2a₃a₅ + 2a₄a₅² − 2a₂a₆ + a₄²a₆ + 2a₅³a₆ − 3a₃a₆² + 5a₄a₅a₆² + 3a₅²a₆³ + 2a₄a₆⁴ + a₅a₆⁵ + b₂ + a₆b₃ − a₅²b₅ − a₄a₆b₅ − a₅a₆²b₅ + a₃b₆ − a₄a₅b₆ − a₅²a₆b₆ − 2a₄a₆²b₆ − a₅a₆³b₆e_(6, 3) = −a₅² − 2a₄a₆ − 3a₅a₆² − a₆⁴ + b₄ + a₆b₅ + a₅b₆ + a₆²b₆

[0132] This leads to the result that, if a (2,2) component d=−a₅−a₆ ²+b₆of the matrix M_(r) is not zero, the rank of the matrix M_(r) becomes 3.Thus, when d≠0, instead of the 6×18 matrix M_(r) the 6×3 matrix M_(r)should be employed that is its minor. It is acceptable to let d≠0 inevaluating efficiency of the algorithm because the probability of d≠0 isconsidered to be 1/q or something like it. From the above equation, itcan be seen that upon eliminating multiplicity successfully, the matrixM_(r) can be constructed with at most 40-times multiplication. Uponpaying attention to the fact that the matrix M_(r) is already a trianglematrix, and that (1,1) and (3,3) components thereof are 1, it can beseen that the row-reduction transformation for the matrix M_(r)′ can beexecuted with at most one-time reciprocal arithmetic and2×4+2×3=14-times multiplication. From the foregoing, the arithmeticquantity of the reduction operation at the time of inputting the idealof a type 61 is at most one-time reciprocal arithmetic and 54-timesmultiplication. Also at the time of inputting the ideal of a type 31,from the similar consideration, it can be seen that the reductionoperation requires most one-time reciprocal arithmetic and 16-timesmultiplication.

[0133] Upon summarizing the foregoing, it follows that the arithmeticquantity of the additive algorithm on Jacobian group of the presentinvention is one as shown in FIG. 16. In FIG. 16, I and M represent thereciprocal arithmetic and the multiplication respectively. On theelliptic curve, the addition (of different elements) can be executedwith one-time reciprocal arithmetic and three-times multiplication, andthe arithmetic of two-times multiple can be executed with one-timereciprocal arithmetic and four-times multiplication. However, so as toobtain a group of the same bit length, the bit length of the finitefield requires three times as large arithmetic quantity as the case ofthe C₃₄ curve does. Suppose that the arithmetic quantity of thereciprocal arithmetic is twenty times as large as that of themultiplication, and that the arithmetic quantity of the reciprocalarithmetic and the multiplication is on the order of a square of the bitlength, then it can be seen that the addition on the C₃₄ curve can beexecuted with 304/(23×9)≈1.47 times as large arithmetic quantities asthat on the elliptic cure can be done, and the arithmetic of two-timesmultiple 384/(24×9)≈1.78 times.

BRIEF DESCRIPTION OF THE DRAWING

[0134] This and other objects, features and advantages of the presentinvention will become more apparent upon a reading of the followingdetailed description and drawings, in which:

[0135]FIG. 1 is a block diagram illustrating an embodiment of thepresent invention;

[0136]FIG. 2 is a functional block diagram of an ideal compositionsection;

[0137]FIG. 3 is a functional block diagram of an ideal reductionsection;

[0138]FIG. 4 is one specific example of an algebraic curve parameterfile A for the C₃₄ curve;

[0139]FIG. 5 is one specific example of an ideal type table for the C₃₄curve;

[0140]FIG. 6 is one specific example of a monomial list table for theC₃₄ curve;

[0141]FIG. 7 is one specific example of a table for a Groebner basisconstruction for the C₃₄ curve;

[0142]FIG. 8 is one specific example of the algebraic curve parameterfile for the C₂₇ curve;

[0143]FIG. 9 is one specific example of the ideal type table for the C₂₇curve;

[0144]FIG. 10 is one specific example of the monomial list table for theC₂₇ curve;

[0145]FIG. 11 is one specific example of the table for a Groebner basisconstruction for the C₂₇ curve;

[0146]FIG. 12 is one specific example of the algebraic curve parameterfile for the C₂₅ curve;

[0147]FIG. 13 is one specific example of the ideal type table for theC₂₅ curve;

[0148]FIG. 14 is one specific example of the monomial list table for theC₂₅ curve;

[0149]FIG. 15 is one specific example of the table for a Groebner basisconstruction table for the C₂₅ curve; and

[0150]FIG. 16 is a table illustrating the arithmetic quantity of theadditive algorithm on Jacobian group in accordance with the presentinvention.

DESCRIPTION OF THE EMBODIMENT

[0151] Embodiments of the present invention will be explained below indetails by employing the accompanied drawings. FIG. 1 is a functionalblock diagram of the embodiment of the present invention, and the FIG. 2is a block diagram illustrating an example of the ideal compositionsection of FIG. 1. FIG. 3 is a block diagram illustrating an example ofa first and a second ideal reduction section of FIG. 1.

[0152] At first, the embodiment of the case in which the C₃₄ curve wasemployed is shown. In this embodiment, the algebraic curve parameterfile of FIG. 4 is employed as an algebraic curve parameter file, theideal type table of FIG. 5 as an ideal type table, the monomial listtable of FIG. 6 as an monomial list table, and the table for a Groebnerbasis construction of FIG. 7 as a table for a Groebner basisconstruction respectively.

[0153] In a Jacobian group element adder of FIG. 1, suppose the Groebnerbases

[0154] I₁={X²+726Y+836X+355,XY+36Y+428X+477, Y²+764Y+425X+865}

[0155] and

[0156] I₂={X²+838Y+784X+97,XY+602Y+450X+291, Y²+506Y+542X+497}

[0157] were input of the ideal of the coordinate ring of the algebraiccurve designated by an algebraic curve parameter file A, whichrepresents an element of the Jacobian group of the C₃₄ curve designatedby an algebraic curve parameter file A 16 and an algebraic curveparameter file A of FIG. 4.

[0158] At first, an ideal composition section 11, which takes theabove-mentioned algebraic curve parameter file A, and theabove-mentioned Groebner bases I₁ and I₂ as an input, operates asfollows according to a flow of a process of the functional block shownin FIG. 2. At first, the ideal composition section 11 makes a referenceto an ideal type table 25 of FIG. 5 in an ideal type classificationsection 21 of FIG. 2, retrieves a record in which the ideal typedescribed in an ideal type field accords with the type of the inputideal I₁ for obtaining a fourteenth record, and acquires a value N₁=31of an ideal type number field and a value d₁=3 of an order field of thefourteenth record.

[0159] Similarly, the ideal composition section 11 retrieves a record inwhich the ideal type accords with the type of the input ideal I₂ forobtaining the fourteenth record, and acquires a value N₂=31 of the idealtype number field and a value d₂=3 of the order field of the fourteenthrecord.

[0160] Next, the ideal composition section 11 calculates the sumd₃=d₁+d₂=6 of said values d₁=3 and d₂=3 of said order field in amonomial vector generation section 22, makes a reference to a monomiallist table 26, retrieves a record of which the value of the order fieldis said d₃=6 for obtaining a first record, and acquires a list 1, X, Y,X², XY, Y², X³, X²Y, XY², and X⁴ of the monomial described in themonomial list field of the first record.

[0161] I₁ and I₂ are different, whereby a remainder to be attained bydividing M_(i) by I₁ for each of M_(i)(1<=i<=10) in said list 1, X, Y,X², XY, Y², X³, X²Y, XY², and X⁴ of said monomial is calculated toobtained a polynomial a^((i)) ₁+a^((i)) ₂X+a^((i)) ₃Y, to arrange itscoefficients in order of the monomial order 1, X, Y, . . . of thealgebraic curve parameter file A, and to generate a vector (a^((i))₁,a^((i)) ₂, a^((i)) ₃). Furthermore, a remainder to be attained bydividing M_(i) by I₂ is calculated to obtain a polynomial b^((i))₁+b^((i)) ₂X+b^((i)) ₃Y, to arrange its coefficients in order of themonomial order 1, X, Y, . . . of the algebraic curve parameter file A,to generate a vector (b^((i)) ₁,b^((i)) ₂,b^((i)) ₃), and to connect theabove-mentioned two vectors for generating a vector v_(i)=(a^((i))₁,a^((i)) ₂,a^((i)) ₃,b^((i)) ₁,b^((i)) ₂,b^((i)) ₃)

[0162] That is, divide M₁=1 by I₁: thenI=0·(X²+726Y+836X+355)+0·(XY+36Y+428X+477)+0·(Y²+746Y+425X+865)+1

[0163] whereby, 1 is obtained as a remainder to generate a vector(1,0,0). Divide M₁=1 by I₂: thenI=0·(X²+838Y+784X+97)+0·(XY+602Y+450X+291)+0·(Y²+506Y+524X+497)+1

[0164] whereby, 1 is obtained as a remainder to generate a vector(1,0,0). These two vectors are connected to generate a vector v₁=(1, 0,0, 1, 0, 0).

[0165] Next, divide M₂=X by I₁: thenX=0(X²+726Y+836X+355)+0·(XY+36Y+428X+477)+0·(Y²+746Y+425X+865)+X

[0166] whereby, X is obtained as a remainder to generate a vector(0,1,0). Divide M₂=X by I₂: then1=0·(X²+838Y+784X+97)+0·(XY+602Y+450X+291)+0·(Y²+506Y+524X+497)+X

[0167] whereby, X is obtained as a remainder to generate a vector(0,1,0). These two vectors are connected to generate a vector v₂=(0, 1,0, 0, 1, 0).

[0168] Next, divide M₃=Y by I₁: thenY=0·(X²+726Y+836X+355)+0·(XY+36Y+428X+477)+0·(Y²+746Y+425X+865)+Y

[0169] whereby, Y is obtained as a remainder to generate a vector(0,0,1). Divide M₃=Y by I₂: thenY=0·(X²+838Y+784X+97)+0·(XY+602Y+450X+291)+0·(Y²+506Y+524X+497)+Y

[0170] whereby, Y is obtained as a remainder to generate a vector(0,0,1). These two vectors are connected to generate a vector v₃=(0, 0,1, 0, 0, 1).

[0171] Next, divide M₄=X² by I₁: thenX²=1·(X²+726Y+836X+355)+0·(XY+36Y+428X+477)+0·(Y²+746Y+425X+865)+654+173X+283Y

[0172] whereby, 654+173X+283Y is obtained as a remainder to generate avector (654,173,283). Divide M₄=X² by I₂: thenX²=1·(X²+838Y+784X+97)+0·(XY+602Y+450X+291)+0·(Y²+506Y+524X+497)+912+225X+171Y,

[0173] whereby, 912+225X+171Y is obtained as a remainder to generate avector (912,225,171). These two vectors are connected to generate avector v₄=(654,173,283,912,225,171).

[0174] Next, divide M₅=XY by I₁: thenXY=0·(X²+726Y+836X+355)+1·(XY+36Y+428X+477)+0·(Y²+746Y+425X+865)+532+581X+973Y

[0175] whereby, 532+581X+973Y is obtained as a remainder to generate avector (532,581,973). Divide M₅=XY by I₂: thenXY=0·(X²+838Y+784X+97)+1·(XY+602Y+450X+291)+0·(Y²+506Y+524X+497)+718+559X+407Y,

[0176] whereby, 718+559X+407Y is obtained as a remainder to generate avector (718,559,407). These two vectors are connected to generate avector v₅=(532,581,973,718,559,407).

[0177] Next, divide M₆=Y² by I₁: thenY²=0·(X²+726Y+836X+355)+0·(XY+36Y+428X+477)+1·(Y²+746Y+425X+865)+144+584X+263Y,

[0178] whereby, 144+584X+263Y is obtained as a remainder to generate avector (144,584,263). Divide M₆=Y² by I₂: thenY²=0·(X²+838Y+784X+97)+0·(XY+602Y+450X+291)+1·(Y²+506Y+524X+497)+512+485X+503Y,

[0179] whereby, 512+485X+503Y is obtained as a remainder to generate avector (512,485,503). These two vectors are connected to generate avector v₆=(144,584,263,512,485,503).

[0180] Next, divide M₇=X³ by I₁: thenX³=(173+X)·(X²+726Y+836X+355)+283·(XY+36Y+428X+477)+0·(Y²+746Y+425X+865)+349+269X+429Y,

[0181] whereby, 349+269X+429Y is obtained as a remainder to generate avector (349,269,429). Divide M₇=X³ by I₂: thenX³=(255+X)·(X²+838Y+784X+97)+171·(XY+602Y+450X+291)+0·(Y²+506Y+524X+497)+53+821X+109Y,

[0182] whereby, 53+821X+109Y is obtained as a remainder to generate avector (53,821,109). These two vectors are connected to generate avector v₇=(349,269,429,53,821,109)

[0183] Next, divide M₈=X²Y by I₁: thenX²Y=Y·(X²+726Y+836X+355)+173·(XY+36Y+428X+477)+283·(Y²+746Y+425X+865)+609+418X+243Y,

[0184] whereby, 609+418X+243Y is obtained as a remainder to generate avector (609,418,243). Divide M₈=X²Y by I₂: thenX²Y=Y·(X²+838Y+784X+97)+225·(XY+602Y+450X+291)+171·(Y²+506Y+524X+497)+888+856X+916Y,

[0185] whereby, 888+856X+916Y is obtained as a remainder to generate avector (888,856,916). These two vectors are connected to generate avector v₈=(609,418,243,888,856,916).

[0186] Next, divide M₉=XY² by I₁: thenXY²=0·(X²+726Y+836X+355)+(581+Y)·(XY+36Y+428X+477)+973·(Y²+746Y+425X+865)+199+720X+418Y,

[0187] whereby, 199+720X+418Y is obtained as a remainder to generate avector (199,720,418). Divide M₉=XY by I₂: thenXY²=0·(X²+838Y+784X+97)+(559+Y)·(XY+602Y+450X+291)+407·(Y²+506Y+524X+497)+310+331X+91Y,

[0188] whereby, 310+331X+91Y is obtained as a remainder to generate avector (310,331,91). These two vectors are connected to generate avector v₉=(199,720,418,310,331,91)

[0189] Next, divide M₁₀=X⁴ by I₁: thenX⁴=(313+173X+X²⁺²⁸³Y)·(X²+726Y+836X+355)+45·(XY+36Y+428X+477)+378·(Y²+746Y+425X+865)+554+498X+143Y

[0190] whereby, 554+498X+143Y is obtained as a remainder to generate avector (554,498,143). Divide M₁₀=X⁴ by I₂: thenX⁴=(78+225X+X²⁺¹⁷¹Y)·(X²+838Y+784X+97)+266·(XY+602Y+450X+291)+989·(Y²+506Y+524X+497)+643+522X+107Y,

[0191] whereby, 643+522X+107Y is obtained as a remainder to generate avector (643,522,107). These two vectors are connected to generate avector v₁₀=(554,498,143,643,522,107). Above, the process of the idealcomposition section 11 in the monomial vector generation section 22 isfinished.

[0192] Next, in a basis construction section 23, the ideal compositionsection 11 inputs ten six-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆,v₇, v₈, v₉, and v₁₀ generated in the monomial vector generation section22 into a linear-relation derivation section 24, and obtains a pluralityof 10-dimensional vectors m₁, m₂, . . . as an output. Thelinear-relation derivation section 24 derives a linear relation of thevectors, which were input, employing a discharging method. Thedischarging method is a well-known art, whereby, as to an operation ofthe linear-relation derivation section 24, only its outline is shownbelow.

[0193] The linear-relation derivation section 24 firstly arranges theten six-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, v₇, v₈, v₉, and v₁₀,which were input, in order for constructing a 10×6 matrix$\begin{matrix}{M_{c} = \begin{pmatrix}1 & 0 & 0 & 1 & 0 & 0 \\0 & 1 & 0 & 0 & 1 & 0 \\0 & 0 & 1 & 0 & 0 & 1 \\654 & 173 & 283 & 912 & 225 & 171 \\532 & 581 & 973 & 718 & 559 & 407 \\144 & 584 & 263 & 512 & 485 & 503 \\349 & 269 & 429 & 53 & 821 & 109 \\609 & 418 & 243 & 888 & 856 & 916 \\199 & 720 & 418 & 310 & 331 & 91 \\554 & 498 & 143 & 643 & 522 & 107\end{pmatrix}} & \left\lbrack {{EQ}.\quad 11} \right\rbrack\end{matrix}$

[0194] Next, the linear-relation derivation section 24 connects a10-dimensional unity matrix to a matrix M_(c) to obtain $\begin{matrix}{M_{c} = \begin{pmatrix}1 & 0 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\0 & 1 & 0 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\0 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\654 & 173 & 283 & 912 & 225 & 171 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\532 & 581 & 973 & 718 & 559 & 407 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 \\144 & 584 & 263 & 512 & 485 & 503 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 \\349 & 269 & 429 & 53 & 821 & 109 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 \\609 & 418 & 243 & 888 & 856 & 916 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 \\199 & 720 & 418 & 310 & 331 & 91 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 \\554 & 498 & 143 & 643 & 522 & 107 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1\end{pmatrix}} & \left\lbrack {{EQ}.\quad 12} \right\rbrack\end{matrix}$

[0195] Next, the linear-relation derivation section 24 triangulates amatrix M′_(c) by adding a constant multiple of an i-th row to an(i+1)-th (i=1,2, . . . 6) row to a tenth row to obtain the followingmatrix m $\begin{matrix}{m = \begin{pmatrix}1 & 0 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\0 & 1 & 0 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\0 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\0 & 0 & 0 & 258 & 52 & 897 & 355 & 836 & 726 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\0 & 0 & 0 & 0 & 621 & 688 & 268 & 365 & 592 & 187 & 1 & 0 & 0 & 0 & 0 & 0 \\0 & 0 & 0 & 0 & 0 & 31 & 514 & 469 & 637 & 669 & 155 & 1 & 0 & 0 & 0 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 28 & 132 & 31 & 271 & 469 & 166 & 1 & 0 & 0 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 856 & 618 & 747 & 909 & 132 & 636 & 0 & 1 & 0 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 652 & 322 & 240 & 978 & 826 & 846 & 0 & 0 & 1 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 333 & 346 & 980 & 935 & 824 & 614 & 0 & 0 & 0 & 1\end{pmatrix}} & \left\lbrack {{EQ}.\quad 13} \right\rbrack\end{matrix}$

[0196] As well known, the vector that is composed of a seventh componentand afterward of the seventh row to the tenth row of the matrix m is avector (m_(1,1),m_(1,2), . . . ,m_(1,n)), (m_(2,1),m_(2,2), . . .,m_(2,n)) . . . } representing a linearly-independent linear dependencerelation Σ_(i) ¹⁰m_(ji)v_(i)=0(j=1, 2, . . . ) of all of the tensix-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, v₇, v₈, v₉, and v₁₀ thatwere input. The linear-relation derivation section 24 outputs a vectorm₁=(28,132,31,271,469,166,1,0,0,0) that is composed of the seventhcomponent and afterward of the seventh row of the matrix m, a vectorm₂=(856,618,747,909,132,636,0,1,0,0) that is composed of the seventhcomponent and afterward of the eighth row of the matrix m, and a vectorm₃=(652,322,240,978,826,846,0,0,1,0) that is composed of the seventhcomponent and afterward of the ninth row of the matrix m, and a vectorm₄=(333,346,980,935,824,614,0,0,0,1) that is composed of the seventhcomponent and afterward of the tenth row of the matrix m. Now return tothe explanation of the process of the ideal composition section 11 inthe basis construction section 23.

[0197] Next, the ideal composition section 11 makes a reference to atable 27 for a Groebner basis construction of FIG. 7, and retrieves arecord, of which the value of the order field is said value d₃=6, and inwhich a vector of which the components that correspond to all componentnumbers described in the component number list field are all zero doesnot lie in said plurality of said vectorsm₁=(28,132,31,271,469,166,1,0,0,0),m₂=(856,618,747,909,132,636,0,1,0,0),m₃=(652,322,240,978,826,846,0,0,1,0), andm₄=(333,346,980,935,824,614,0,0,0,1). The value of the order field of afirst record is 6, and a vector, of which the component number lists 7,8, 9, and 10 of the first record are all zero, does not lie in thevectors m₁, m₂, m₃, and m₄, whereby the first record is obtained as aretrieval result

[0198] Furthermore, the value of a first vector type of the first recordis (*,*,*,*,*,*,1,0,0,0)(A code * is interpreted as representing anynumber), which coincides with the vectorm₁=(28,132,31,271,469,166,1,0,0,0), whereby the vector m₁ is regarded asa column of the coefficient of each monomial of the monomial order 1, X,Y, X², XY, Y², X³, X²Y, XY², and X⁴ of the algebraic curve parameterfile A to generate a polynomial f₁=28+132X+31Y+271X²+469XY+166Y²+X³

[0199] Similarly, the value of a second vector type of the first recordis (*,*,*,*,*,*,0,1,0,0)(A code * is interpreted as representing anynumber), which coincides with the vectorm₂=(856,618,747,909,132,636,0,1,0,0), whereby the vector m₂ is regardedas a column of the coefficient of each monomial of the monomial order 1,X, Y, X², XY, Y², X³, X²Y, XY², and X⁴ of the algebraic curve parameterfile A to generate a polynomial f₂=856+618X+747Y+909X²+132XY+636Y²+X²Y.

[0200] Similarly, the value of a third vector type of the first recordis (*,*,*,*,*,*,0,0,1,0)(A code * is interpreted as representing anynumber), which coincides with the vectorm₃=(652,322,240,978,826,846,0,0,1,0), whereby the vector m₃ is regardedas a column of the coefficient of each monomial of the monomial order 1,X, Y, X², XY, Y², X³, X²Y, XY², and X⁴ of the algebraic curve parameterfile A to generate a polynomial f₃=652+322X+240Y+978X²+826XY+846Y²+XY².Finally, the ideal composition section 11 constructs a set J={f₁,f₂,f₃}of the polynomial to output it. Above, the operation of the idealcomposition section 11 is finished.

[0201] Next, the first ideal reduction section 12, which takes as aninput the algebraic curve parameter file A of FIG. 4, and the Groebnerbasis J={28+132X+31Y+271X²+469XY+166Y²+X³,856+618X+747Y+909X²+132XY+636Y²+X²Y,652+322X+240Y+978X²+826XY+846Y²+XY²}that the ideal composition section11 output, operates as follows according to a flow of the process of thefunctional block shown in FIG. 3.

[0202] At first, the ideal reduction section 12 makes a reference to anideal type table 35 of FIG. 5 in an ideal type classification section 31of FIG. 3, retrieves a record in which the ideal type described in theideal type field accords with the type of the input ideal J forobtaining a first record, and acquires a value N=61 of the ideal typenumber field and a value d=3 of the reduction order field of the firstrecord. Next, the ideal reduction section 12 confirms that said valued=3 is not zero, makes a reference to a monomial list table 36 in apolynomial vector generation section 32, retrieves a record of which thevalue of the order field is said d=3 for obtaining a fourth record, andacquires a list 1, X, Y, X², XY, Y², and X³ of the monomial described inthe monomial list field of the fourth record.

[0203] Furthermore, the ideal reduction section 12 acquires a firstelement f=28+132X+31Y+271X²+469XY+166Y²+X³, a second elementg=856+618X+747Y+909X²+132XY+636Y²+X²Y, and a third elementh=652+322X+240Y+978X²+826XY+846Y²+XY² of J in the polynomial vectorgeneration section 32, regards a coefficient list 0, 7, 0, 0, 0, 0, 0,0, 0, 1, and 1 of the algebraic curve parameter file A as a column ofthe coefficient of each monomial of the monomial order 1, X, Y, X², XY,Y², X³, X²Y, XY², X⁴, and Y³ of the algebraic curve parameter file A,and generates a defining polynomial F=Y³+X⁴+7X.

[0204] Next, for each M_(i)(1<=i<=7) in said list 1, X, Y, X², XY, Y²,and X³ of said monomial, the ideal reduction section 12 calculates aremainder equation r_(i) of a product M_(i)·g of M_(i) and thepolynomial g by the polynomials f and F in the polynomial vectorgeneration section 32, arranges its coefficients in order of themonomial order 1, X, Y, . . . of the algebraic curve parameter file A,and generates a vector w^((i)) ₁. Furthermore, the ideal reductionsection 12 calculates a remainder equation si of a product M_(i)·h of Mand the polynomial h by the polynomials f and F, arranges itscoefficient in order of the monomial order 1, X, Y, . . . of thealgebraic curve parameter file A, and generates a vector w^((i)) ₂, andconnects the above-mentioned two vectors w^((i)) ₁ and w^((i)) ₂ forgenerating a vector v_(i).

[0205] That is, at first, for a first monomial M₁=1, divide1·g=856+618X+747Y+909X²+132XY+636Y²+X²Y byf=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X: theng=0·f+0·F+856+618X+747Y+909X²+132XY+636Y²+X²Y, whereby a remainder856+618X+747Y+909X²+132XY+636Y²+X²Y is obtained to generate a vectorw^((i))=(856,618,747,909,132,636,1,0,0).

[0206] Also, divide 1·h=652+322X+240Y+978X²+826XY+846Y²+XY² byf=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X: thenh=0·f+0·F+652+322X+240Y+978X²+826XY+846Y²+XY², whereby a remainder652+322X+240Y+978X²+826XY+846Y²+XY² is obtained to generate a vectorw^((i)) ₂=(652,322,240,978,826,846,0,1,0). And, the vectors w⁽¹⁾ ₁ andw⁽¹⁾ ₂ are connected to obtain a vectorv₁=(856,618,747,909,132,636,1,0,0,652,322,240,978,826,846, 0,1,0).

[0207] Next, for a second monomial M₂=X, divideXg=X(856+618X+747Y+909X²+132XY+636Y²+X²Y) byf=28+132X+31Y+271X²+469XY+166Y²+X and F=Y³+X⁴+7X: thenXg=(319+166Y+Y)f+843F+149+667X+220X²+173Y+235XY+709X²Y+492Y²+863XY²,whereby a remainder 149+667X+220X²+173Y+235XY+709X²Y+492Y²+863XY² isobtained to generate a vector w⁽²⁾₁=(149,667,173,220,235,492,709,863,0).

[0208] Also, divide Xh=X(652+322X+240Y+978X²+826XY+846Y²+XY²) byf=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X:Xh=978f+0·F+868+708X+651X²+961Y+653XY+826X²Y+101Y²⁺⁸⁴⁶XY²+X²Y², wherebya remainder 868+708X+651X²+961Y+653XY+826X²Y+101Y²⁺⁸⁴⁶XY²+X²Y² isobtained to generate a vector w⁽²⁾₂=(868,708,961,651,653,101,826,846,1). And, the vectors w⁽²⁾ ₁ and w⁽²⁾₂ are connected to obtain a vectorv₂=(149,667,173,220,235,492,709,863,0,868,708,961,651,653,101,826,846,1).

[0209] Next, for a third monomial M₃=Y, divideYg=Y(856+618X+747Y+909X²+132XY+636Y²+X²Y) byf=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X: Yg=(826+373X)f+636F+79+179X+357X²+475Y+216XY+529X²Y+855Y²+772XY²+X²Y², whereby aremainder 79+179X+357X²+475Y+216XY+529X²Y+855Y²+772XY²+X²Y² is obtainedto generate a vector w⁽³⁾ ₁=(79,179,475,357,216,855,529,772,1).

[0210] Also, divide Yh=Y(652+322X+240Y+978X²+826XY+846Y²+XY²) byf=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X: thenYh=(327+595X+1008X²+469Y)f+(685+X)F+934+966X+358X²+590Y+694XY+473X²Y+31Y²+939XY²+166X²Y²whereby a remainder 934+966X+358X²+590Y+694XY+473X²Y+31Y²+939XY²+166X²Y²is obtained to generate a vector w⁽³⁾₂=(934,966,590,358,694,31,473,939,166). And, the vectors w⁽³⁾ ₁ and w⁽³⁾₂ are connected to obtain a vectorv₃=(79,179,475,357,216,855,529,772,1,934,966,590,358,694,31,473,939,166).

[0211] Next, for a fourth monomial M₄=X², divideX²g=X²(856+618X+747Y+909X²+132XY+636Y²+X²Y) byf=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X: thenX²g=(645+969X+166X²+709Y+XY)f+(359+843X)F+102+241X+394X²513Y+647XY+683X²Y+103Y²+1004XY²+863X²Y²,whereby a remainder102+241X+394X²+513Y+647XY+683X²Y+103Y²+1004XY²+863X²Y² is obtained togenerate a vector w⁽⁴⁾ ₁=(102,241,513,394,647,103,683,1004,863).

[0212] Also, divide X²h=X²(652+322X+240Y+978X²+826XY+846Y²+XY²) byf=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X: thenX²h=(725+16X+782X²+754Y+166XY+Y²)f+(930+227X+843Y)F+889+260X+560X²+809Y+425XY+552X²Y+535Y²+671XY²+763X²Y²,whereby a remainder889+260X+560X²+809Y+425XY+552X²Y+535Y²+671XY²+763X²Y² is obtained togenerate a vector w⁽⁴⁾ ₂=(889,260,809,560,425,535,552,671,763). And, thevectors w⁽⁴⁾ ₁ and w⁽⁴⁾ ₂ are connected to obtain a vectorv₄=(102,241,513,394,647,103,683,1004,863,889,260,809,560,425,535,552,671,763).

[0213] Next, for a fifth monomial M₅=XY, divideXYg=XY(856+618X+747Y+909X²+132XY+636Y²+X²Y) byf=28+132X+31Y+271X²+469XY+166Y²+X and F=Y³+X⁴+7X: thenXYg=(95+3X+146X²+457Y+166XY+Y²)f+(791+863X+843Y)F+367+X+54X²+403Y+361XY+276X²Y+305Y²+600XY²+689X²Y²,whereby a remainder 367+X+54X²+403Y+361XY+276X²Y+305Y²+600XY²+689X²Y² isobtained to generate a vector w⁽⁵⁾ ₁=(367,1,403,54,361,305,276,600,689).

[0214] Also, divide XYh=XY(652+322X+240Y+978X²+826XY+846Y²+XY²) byf=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X: thenXYh=(804+648X+246X²+1008X³+629Y+782XY+166Y²)f+(421+25X+X²+696Y)F+695+924X+289X²+851Y+210XY+321X²Y+802Y²+522XY²+278X²Y², whereby a remainder695+924X+289X²+851Y+210XY+321X²Y+802Y²+522XY²+278X²Y² is obtained togenerate a vector w⁽⁵⁾ ₂=(695,924,851,289,210,802,321,522,278). And, thevectors w⁽⁵⁾ ₁ and w⁽⁵⁾ ₂ are connected to obtain a vectorv₅=(367,1,403,54,361,305,276,600,689,695,924,851,289,210,802,321,522,278).

[0215] Next, for a sixth monomial M₆=Y², divideY²g=Y²(856+618X+747Y+909X²+132XY+636Y²+X²Y) byf=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X: thenY²g=(687+214X+320X²+1008X³+77Y+146XY+166Y²)f+(981+960X+X²+323Y)F+944+384X+956X²+763Y+737XY+925X²Y+859Y²+416XY²+814X²Y²,whereby a remainder944+384X+956X²+763Y+737XY+925X²Y+859Y²+416XY²+814X²Y² is obtained togenerate a vector w⁽⁶⁾ ₁=(944,384,763,956,737,859,925,416,814).

[0216] Also, divide Y²h=Y²(652+322X+240Y+978X²+826XY+846Y²+XY²) byf=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X: thenY²h=(260+17X+731X²+843X³+382Y+246XY+1008X²Y+782Y²)f(369+868X+166X²+186Y+XY)F+792+963X+643X²+415Y+539XY+887X²Y+438Y²+102XY²+363X²Y²,whereby a remainder792+963X+643X²+415Y+539XY+887X²Y+438Y²+102XY²+363X²Y² is obtained togenerate a vector w⁽⁶⁾ ₂=(792,963,415,643,539,438,887,102,363). And, thevectors w⁽⁶⁾ ₁ and w⁽⁶⁾ ₂ are connected to obtain a vectorv₆=(944,384,763,956,737,859,925,416,814,792,963,415,643,539,438,887,102,363).

[0217] Finally, for a seventh monomial M₇=X³, divideX³g=X³(856+618X+747Y+909X²+132XY+636Y²+X²Y) byf=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X: thenX³g=(323+583X+814X²+166X³+96Y+689XY+X²Y+863Y²)f+(698+514X+843X²+20Y)F+37+730X+831X²+416Y+136XY+55X²Y+971Y²+398XY²+5X²Y², whereby a remainder37+730X+831X²+416Y+136XY+55X²Y+971Y²+398XY²+5X²Y² is obtained togenerate a vector w⁽⁷⁾ ₁=(37,730,416,831,136,971,55,398,5).

[0218] Also, divide X³h=X³(652+322X+240Y+978X²+826XY+846Y²+XY²) byf=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X: thenX³h=(449+750X+363X²+782X³+102Y+278XY+166X²Y+763Y²+XY²)f+(784+583X+227X²+476Y+843XY)F+545+9X+173X²+378Y+902XY+16X²Y+831Y²+820XY²+909X²Y²,whereby a remainder 545+9X+173X²+378Y+902XY+16X²Y+831Y²+820XY²+909X²Y²is obtained to generate a vector w⁽⁷⁾₂=(545,9,378,173,902,831,16,820,909). And, the vectors w⁽⁷⁾ ₁ and w⁽⁷⁾ ₂are connected to obtain a vectorv₇=(37,730,416,831,136,971,55,398,5,545,9,378,173,902,831, 16,820,909).Above, the process of the first ideal reduction section 12 in thepolynomial vector generation section 32 is finished.

[0219] Next, in a basis construction section 33, the first idealreduction section 12 inputs seven 18-dimensional vectors v₁, v₂, v₃, v₄,v₅, v₆, and v₇, generated in the polynomial vector generation section 32into a linear-relation derivation section 34, and obtains a plurality ofseven-dimensional vectors m₁, m₂, . . . as an output. Thelinear-relation derivation section 34 derives a linear relation of thevectors, which were input, employing a discharging method. Thedischarging method belongs to a known art, whereby as to an operation ofthe linear-relation derivation section 34, only its outline is shownbelow.

[0220] The linear-relation derivation section 34 firstly arranges theseven 18-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, and v₇, which wereinput, in order for constructing a 7×18 matrix $\begin{matrix}{M_{R} = \begin{pmatrix}856 & 618 & 747 & 909 & 132 & 636 & 1 & 0 & 0 & 652 & 322 & 240 & 978 & 826 & 846 & 0 & 1 & 0 \\149 & 667 & 173 & 220 & 235 & 492 & 709 & 863 & 0 & 868 & 708 & 961 & 651 & 653 & 101 & 826 & 846 & 1 \\79 & 179 & 475 & 357 & 216 & 855 & 529 & 772 & 1 & 934 & 966 & 590 & 358 & 694 & 31 & 473 & 939 & 166 \\102 & 241 & 513 & 394 & 647 & 103 & 683 & 1004 & 863 & 889 & 260 & 809 & 560 & 425 & 535 & 552 & 671 & 763 \\367 & 1 & 403 & 54 & 361 & 305 & 276 & 600 & 689 & 695 & 924 & 851 & 289 & 210 & 802 & 321 & 522 & 278 \\944 & 384 & 763 & 956 & 737 & 859 & 925 & 416 & 814 & 792 & 963 & 415 & 643 & 539 & 438 & 887 & 102 & 363 \\37 & 730 & 416 & 831 & 136 & 971 & 55 & 398 & 5 & 545 & 9 & 378 & 173 & 902 & 831 & 16 & 820 & 909\end{pmatrix}} & \left\lbrack {{EQ}.\quad 14} \right\rbrack\end{matrix}$

[0221] Next, the linear-relation derivation section 34 connects aseventh-dimensional unity matrix to the matrix M_(R) to construct$\begin{matrix}{M_{R}^{\prime} = \begin{pmatrix}856 & 618 & 747 & 909 & 132 & 636 & 1 & 0 & 0 & 652 & 322 & 240 & 978 & 826 & 846 & 0 & 1 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\149 & 667 & 173 & 220 & 235 & 492 & 709 & 863 & 0 & 868 & 708 & 961 & 651 & 653 & 101 & 826 & 846 & 1 & 0 & 1 & 0 & 0 & 0 & 0 & 0 \\79 & 179 & 475 & 357 & 216 & 855 & 529 & 772 & 1 & 934 & 966 & 590 & 358 & 694 & 31 & 473 & 939 & 166 & 0 & 0 & 1 & 0 & 0 & 0 & 0 \\102 & 241 & 513 & 394 & 647 & 103 & 683 & 1004 & 863 & 889 & 260 & 809 & 560 & 425 & 535 & 552 & 671 & 763 & 0 & 0 & 0 & 1 & 0 & 0 & 0 \\367 & 1 & 403 & 54 & 361 & 305 & 276 & 600 & 689 & 695 & 924 & 851 & 289 & 210 & 802 & 321 & 522 & 278 & 0 & 0 & 0 & 0 & 1 & 0 & 0 \\944 & 384 & 763 & 956 & 737 & 859 & 925 & 416 & 814 & 792 & 963 & 415 & 643 & 539 & 438 & 887 & 102 & 363 & 0 & 0 & 0 & 0 & 0 & 1 & 0 \\37 & 730 & 416 & 831 & 136 & 971 & 55 & 398 & 5 & 545 & 9 & 378 & 173 & 902 & 831 & 16 & 820 & 909 & 0 & 0 & 0 & 0 & 0 & 0 & 1\end{pmatrix}} & \left\lbrack {{EQ}.\quad 15} \right\rbrack\end{matrix}$

[0222] Next, the linear-relation derivation section 34 triangulates amatrix M′_(R) by adding a constant multiple of an i-th row to an(i+1)-th row (i=1,2,and 3) to a seventh row to obtain the followingmatrix m. $\begin{matrix}{m = \begin{pmatrix}856 & 618 & 747 & 909 & 132 & 636 & 1 & 0 & 0 & 652 & 322 & 240 & 978 & 826 & 846 & 0 & 1 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\0 & 62 & 485 & 393 & 47 & 320 & 677 & 863 & 0 & 184 & 494 & 344 & 634 & 455 & 272 & 826 & 814 & 1 & 977 & 1 & 0 & 0 & 0 & 0 & 0 \\0 & 0 & 252 & 630 & 861 & 845 & 645 & 389 & 1 & 380 & 422 & 1006 & 632 & 736 & 748 & 221 & 979 & 217 & 281 & 51 & 1 & 0 & 0 & 0 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 982 & 226 & 146 & 1 & 0 & 0 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 449 & 79 & 320 & 0 & 1 & 0 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 544 & 564 & 195 & 0 & 0 & 1 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & \square & \square & \square & 79 & 930 & 1004 & 0 & 0 & 0 & 1\end{pmatrix}} & \left\lbrack {{EQ}.\quad 16} \right\rbrack\end{matrix}$

[0223] As well known, the vector that is composed of a nineteenthcomponent and afterward of a fourth row to a seventh row of the matrix mis a vector {(m_(1,1),m_(1,2), . . . ,m_(1,7)), (m_(2,1),m_(2,2), . . .,m_(2,7)), . . . } representing a linearly-independent linear dependencerelation Σ_(i) ⁷m_(ji)v_(i)=0(j=1,2 . . . ) of all of the seven18-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, and v₇ that were input.The linear-relation derivation section 34 outputs a vectorm₁=(982,226,146,1,0,0,0) that is composed of the nineteenth componentand afterward of the fourth row of the matrix m, a vectorm₂=(449,79,320,0,1,0,0) that is composed of the nineteenth component andafterward of the fifth row of the matrix m, and a vectorm₃=(544,564,195,0,0,1,0) that is composed of the nineteenth componentand afterward of the sixth row of the matrix m, and a vectorm₄=(79,930,1004,0,0,0,1) that is composed of the nineteenth componentand afterward of the seventh row of the matrix m.

[0224] Now return to the explanation of the process of the first idealreduction section 12 in the basis construction section 33. Next, thisideal reduction section 12 makes a reference to a table 37 for aGroebner basis construction of FIG. 7, and retrieves a record, of whichthe value of the order field is said value d=3, and in which a vector ofwhich the components that correspond to all component numbers describedin the component number list field are all zero does not lie in saidplurality of said vectors m₁=(982,226,146,1,0,0,0),m₂=(449,79,320,0,1,0,0), m₃=(544,564,195,0,0,1,0), andm₄=(79,930,1004,0,0,0,1). The value of the order field of a fourteenthrecord is 3, and a vector, of which the components that correspond tothe component number lists 4, 5, 6, and 7 of the fourteenth record areall zero, does not lie in the vectors m₁, m₂, m₃, and m₄, whereby thefourteenth record is obtained as a retrieval result.

[0225] Furthermore, the value of the first vector type of the fourteenthrecord is (*,*,*,1,0,0,0)(A code * is interpreted as representing anynumber), which coincides with the vector m₁=(982,226,146,1,0,0,0),whereby the vector m₁ is regarded as a column of the coefficient of eachmonomial of the monomial order 1, X, Y, X², XY, Y², and X³ of thealgebraic curve parameter file A to generate a polynomialf₁=982+226X+146Y+X².

[0226] Similarly, the value of the second vector type of the fourteenthrecord is (*,*,*,0,1,0,0) (A code * is interpreted as representing anynumber), which coincides with the vector m₂=(449,79,320,0,1,0,0),whereby the vector m₂ is regarded as a column of the coefficient of eachmonomial of the monomial order 1, X, Y, X², XY, Y², and X³ of thealgebraic curve parameter file A to generate a polynomialf₂=449+79X+320Y+XY.

[0227] Similarly, the value of the third vector type of the fourteenrecord is (*,*,*,0,0,1,0)(A code * is interpreted as representing anynumber), which coincides with the vector m₃=(544,564,195,0,0,1,0),whereby the vector m₃ is regarded as a column of the coefficient of eachmonomial of the monomial order 1, X, Y, X², XY, Y², and X³of thealgebraic curve parameter file A to generate a polynomialf₃=544+564X+195Y+Y².

[0228] Finally, the ideal reduction section 12 constructs a setJ*={f₁=982+226X+146Y+X²,f₂=449+79X+320Y+XY, f₃=544+564X+195Y+Y²} of thepolynomial to output it. Above, the operation of the first idealreduction section 12 is finished.

[0229] Next, a second ideal reduction section 13, which takes as aninput the algebraic curve parameter file A 30 of FIG. 4, and theGroebner basis J*={982+226X+146Y+X²,449+79X+320Y+XY,544+564X+195Y²} thatthe first ideal reduction section 12 output, operates as followsaccording to a flow of the process of the functional block shown in FIG.3. At first, in the ideal type classification section 31 of FIG. 3, thesecond ideal reduction section 13 makes a reference to the ideal typetable 35 of FIG. 5, retrieves a record in which the ideal type describedin the ideal type field accords with the type of the input ideal J* forobtaining a fourteenth record, and acquires a value N=31 of the idealtype number field and a value d=3 of the reduction order field of thefourteenth record.

[0230] Next, the ideal reduction section 13 confirms that said value d=3is not zero, makes a reference to the monomial list table 36 in thepolynomial vector generation section 32, retrieves a record of which thevalue of the order field is said d=3 for obtaining a fourth record, andacquires a list 1, X, Y, X², XY, Y², and X³ of the monomial described inthe monomial list field of the fourth record.

[0231] Furthermore, the ideal reduction section 13 acquires a firstelement f=982+226X+146Y+X², a second element g=449+79X+320Y+XY, and athird element h=544+564X+195Y+Y² of J*, regards a coefficient list0,7,0,0,0,0,0,0,0,1,1 of the algebraic curve parameter file A as acolumn of the coefficient of each monomial of the monomial order 1, X,Y, X², XY, Y², X³, X²Y, XY², X⁴, and Y³ of the algebraic curve parameterfile A, and generates a defining polynomial F=Y³+X⁴+7X.

[0232] Next, for each of M_(i)(1<=i<=7) in said list 1, X, Y, X², XY,Y², and X³ of said monomial, the ideal reduction section 13 calculates aremainder equation r_(i) of a product M_(i)·g of M_(i) and thepolynomial g by the polynomials f and F, arranges its coefficients inorder of the monomial order 1, X, Y, . . . of the algebraic curveparameter file A, and generates a vector w^((i)) ₁. Furthermore, theideal reduction section 13 calculates a remainder equation s_(i) of aproduct M_(i)·h of M_(i) and the polynomial h by the polynomials f andF, arranges its coefficients in order of the monomial order 1, X, Y, . .. of the algebraic curve parameter file A, and generates a vectorw^((i)) ₂, and connects the above-mentioned two vectors w^((i)) ₁ andw^((i)) ₂ for generating a vector v_(i).

[0233] That is, at first, for a first monomial M₁=1, divide1·g=449+79X+320Y+XY by f=982+226X+146Y+X² and F=Y³+X⁴+7X, :theng=0·f+0·F+449+79X+320Y+XY, whereby a remainder 449+79X+320Y+XY isobtained to generate a vector w⁽¹⁾ ₁=(449,79,320,1,0,0). Also, divide1·h=544+564X+195Y+Y² by f=982+226X+146Y+X² and F=Y³+X⁴+7X: thenh=0·f+0·F+544+564X+195Y+Y², whereby a remainder 544+564X+195Y+Y² isobtained to generate a vector w⁽¹⁾ ₂=(544,564,195,0,1,0). And, thevectors w⁽¹⁾ ₁ and w⁽¹⁾ ₂ are connected to obtain a vectorv₁=(449,79,320,1,0,0,544,564,195,0,1,0).

[0234] Next, for a second monomial M₂=X, divide Xg=X(449+79X+320Y+XY) byf=982+226X+146Y+X² and F=Y³+X⁴+7X: thenXg=(79+Y)f+0·F+115+757X+601Y+94XY+863Y², whereby a remainder115+757X+601Y+94XY+863Y² is obtained to generate a vector w⁽²⁾₁=(115,757,601,94,863,0).

[0235] Also, divide Xh=X(544+564X+195Y+Y²) by f=982+226X+146Y+X² andF=Y³+X⁴+7X: then Xh=564f+0·F+93+214X+394Y+195XY+XY , whereby a remainder93+214X+394Y+195XY+XY² is obtained to generate a vector w⁽²⁾₂=(93,214,394,195,0,1). And, the vectors w⁽²⁾ ₁ and w⁽²⁾ ₂ are connectedto obtain a vector v₂=(115,757,601,94,863,0,93,214,394,195,0,1).

[0236] Next, for a third monomial M₃=Y, divide Yg=Y(449+79X+320Y+XY) byf=982+226X+146Y+X² and F=Y³+X⁴+7X: then Yg=0·f+0·F+449Y+79XY+320Y²+XY²,whereby a remainder 449Y+79XY+320Y²+XY² is obtained to generate a vectorw⁽³⁾ ₁=(0,0,449,79,320,1).

[0237] Also, divide Yh=Y(544+564X+195Y+Y²) by f=982+226X+146Y+X² andF=Y³+X⁴+7X: thenYh=(356+226X+1008X²+146Y)f+1·F+531+305X+942Y+157XY+68Y², whereby aremainder 531+305X+942Y+157XY+68Y² is obtained to generate a vector w⁽³⁾₂=(531,305,942,157,68,0). And, the vectors w⁽³⁾ ₁ and w⁽³⁾ ₂ areconnected to obtain a vector v₃=(0,0,449,79,320,1,531,305,942,157,68,0).

[0238] Next, for a fourth monomial M₄=X², divide X²g=X²(449+79X+320Y+XY)by f=982+226X+146Y+X² and F=Y³+X⁴+7X: thenX²g=(757+79X+94Y+XY)f+0·F+259+563X+988Y+546XY+402Y²+863XY², whereby aremainder 259+563X+988Y+546XY+402Y²+863XY² is obtained to generate avector w⁽⁴⁾ ₁=(259,563,988,546,402,863).

[0239] Also, divide X²h=X² (544+564X+195Y+Y²) by f=982+226X+146Y+X² andF=Y³+X⁴+7X: thenX²h=(706+865X+146X²+68Y+Y²)f+863F+900+27X+669Y+611XY+189Y²+783XY²,whereby a remainder 900+27X+669Y+611XY+189Y²+783XY² is obtained togenerate a vector w⁽⁴⁾ ₂=(900,27,669,611,189,783). And, the vectors w⁽⁴⁾₁ and w⁽⁴⁾ ₂ are connected to obtain a vectorv₄=(259,563,988,546,402,863,900,27,669,611,189,783).

[0240] Next, for a fifth monomial M₅=XY, divide XYg=XY(449+79X+320Y+XY)by f=982+226X+146Y+X² and F=Y³+X⁴+7X: then XYg=(492+301X+146X²+961Y+Y²)f+863F+167+875X+529Y+648XY+981Y²+94XY² whereby a remainder167+875X+529Y+648XY+981Y²+94XY² is obtained to generate a vector w⁽⁵⁾₁=(167,875,529,648,981,94). Also, divide XYh=XY(544+564X+195Y+Y²) byf=982+226X+146Y+X² and F=Y³+X⁴+7X: thenXYh=(305+356X+226X²+1008X³+157Y+146XY)f+XF+163+213X+213X+69Y+775XY+285Y²+68XY²,whereby a remainder 163+213X+69Y+775XY+285Y²+68XY² is obtained togenerate a vector w⁽⁵⁾ ₂=(163,213,69,775,285,68). And, the vectors w⁽⁵⁾₁ and w⁽⁵⁾ ₂ are connected to obtain a vectorv₅=(167,875,529,648,981,94,163,213,69,775,285,68).

[0241] Next, for a sixth monomial M₆=Y², divide Y²g=Y²(449+79X+320Y+XY)by f=982+226X+146Y+X² and F=Y³+X⁴+7X: thenY²g=(208+28X+915X²+1008X³+908Y+146XY)f+(320+X)F+571+949X+202Y+482XY+60Y²+961XY²,whereby a remainder 571+949X+202Y+482XY+60Y²+961XY² is obtained togenerate a vector w⁽⁶⁾ ₁=(571,949,202,482,60,961).

[0242] Also, divide Y²h=Y² (544+564X+195Y+Y²) by f=982+226X+146Y+X² andF=Y³+X⁴+7X: thenY²h=(1001+233X+941X²+194Y+226XY+1008X²Y+146Y²)f+(68+Y)F+793+560X+352Y+881XY+378Y²+157XY²,whereby a remainder 793+560X+352Y+881XY+378Y2+157XY² is obtained togenerate a vector w⁽⁶⁾ ₂=(793,560,352,881,378,157). And, the vectorsw⁽⁶⁾ ₁ and w⁽⁶⁾ ₂ are connected to obtain a vectorv₆=(571,949,202,482,60,961,793,560,352,881,378,157).

[0243] Finally, for a seventh monomial M₇=X³, divideX³g=X³(449+79X+320Y+XY) by f=982+226X+146Y+X² and F=Y³+X⁴+7X: thenX³g=(370+198X+961X²+926Y+94XY+X²Y+863Y²)f+127F+909+548X+243Y+460XY+104Y²+101XY², whereby a remainder909+548X+243Y+460XY+104Y²+101XY² is obtained to generate a vector w⁽⁷⁾₁=(909,548,243,460,104,101).

[0244] Also, divide X³h=X³ (544+564X+195Y+Y²) by f=982+226X+146Y+X² andF=Y³+X⁴+7X: thenX³h=(834+283X+157X²+146X³+52Y+68XY+783Y²+XY²)f+(708+863X)F+320+866X+720Y+225XY+432Y²+815XY²,whereby a remainder 320+866X+720Y+225XY+432Y²+815XY² is obtained togenerate a vector w⁽⁷⁾ ₂=(320,866,720,225,432,815). And, the vectorsw⁽⁷⁾ ₁ and w⁽⁷⁾ ₂ are connected to obtain a vectorv₇=(909,548,243,460,104,101,320,866,720,225,432,815). Above, the processof the second ideal reduction section 13 reduction section 13 in thepolynomial vector generation section 32 is finished.

[0245] Next, in the basis construction section 33, the second idealreduction section 13 inputs seven 12-dimensional vectors v₁, v₂, v₃, v₄,v₅, v₆, and v₇ generated in the polynomial vector generation section 32into the linear-relation derivation section 34, and obtains a pluralityof seven-dimensional vectors m₁,m₂, . . . as an output. Thelinear-relation derivation section 34 derives a linear relation of thevectors, which were input, employing a discharging method. Thedischarging method belongs to a known art, whereby as to an operation ofthe linear-relation derivation section 34, only its outline is shownbelow.

[0246] The linear-relation derivation section 34 firstly arranges theseven 12-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, and v₇, which wereinput, in order for constructing a 7×12 matrix $\begin{matrix}{M_{R} = \begin{pmatrix}449 & 79 & 320 & 1 & 0 & 0 & 544 & 564 & 195 & 0 & 1 & 0 \\115 & 757 & 601 & 94 & 863 & 0 & 93 & 214 & 394 & 195 & 0 & 1 \\0 & 0 & 449 & 79 & 320 & 1 & 531 & 305 & 942 & 157 & 68 & 0 \\259 & 563 & 988 & 546 & 402 & 863 & 900 & 27 & 669 & 611 & 189 & 783 \\167 & 875 & 529 & 648 & 981 & 94 & 163 & 213 & 69 & 775 & 285 & 68 \\571 & 949 & 202 & 482 & 60 & 961 & 793 & 560 & 352 & 881 & 378 & 157 \\909 & 548 & 243 & 460 & 104 & 101 & 320 & 866 & 720 & 225 & 432 & 815\end{pmatrix}} & \left\lbrack {{EQ}.\quad 17} \right\rbrack\end{matrix}$

[0247] Next, the linear-relation derivation section 34 connects aseventh-dimensional unity matrix to the matrix M_(R) to construct$\begin{matrix}{M_{R}^{\prime} = \begin{pmatrix}449 & 79 & 320 & 1 & 0 & 0 & 544 & 564 & 195 & 0 & 1 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\115 & 757 & 601 & 94 & 863 & 0 & 93 & 214 & 394 & 195 & 0 & 1 & 0 & 1 & 0 & 0 & 0 & 0 & 0 \\0 & 0 & 449 & 79 & 320 & 1 & 531 & 305 & 942 & 157 & 68 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 \\259 & 563 & 988 & 546 & 402 & 863 & 900 & 27 & 669 & 611 & 189 & 783 & 0 & 0 & 0 & 1 & 0 & 0 & 0 \\167 & 875 & 529 & 648 & 981 & 94 & 163 & 213 & 69 & 775 & 285 & 68 & 0 & 0 & 0 & 0 & 1 & 0 & 0 \\571 & 949 & 202 & 482 & 60 & 961 & 793 & 560 & 352 & 881 & 378 & 157 & 0 & 0 & 0 & 0 & 0 & 1 & 0 \\909 & 548 & 243 & 460 & 104 & 101 & 320 & 866 & 720 & 225 & 432 & 815 & 0 & 0 & 0 & 0 & 0 & 0 & 1\end{pmatrix}} & \left\lbrack {{EQ}.\quad 18} \right\rbrack\end{matrix}$

[0248] Next, the linear-relation derivation section 34 triangulates amatrix M′_(R) by adding a constant multiple of an i-th row to an(i+1)-th row (i=1,2,and 3) to a seventh row to obtain the following amatrix m. $\begin{matrix}{m = \begin{pmatrix}449 & 79 & 320 & 1 & 0 & 0 & 544 & 564 & 195 & 0 & 1 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\0 & 548 & 955 & 896 & 863 & 0 & 493 & 510 & 389 & 195 & 802 & 1 & 802 & 1 & 0 & 0 & 0 & 0 & 0 \\0 & 0 & 449 & 79 & 320 & 1 & 531 & 305 & 942 & 157 & 68 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 982 & 226 & 146 & 1 & 0 & 0 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 53 & 941 & 915 & 0 & 1 & 0 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 394 & 852 & 48 & 0 & 0 & 1 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 382 & 194 & 908 & 0 & 0 & 0 & 1\end{pmatrix}} & \left\lbrack {{EQ}.\quad 19} \right\rbrack\end{matrix}$

[0249] As well known, the vector that is composed of a thirteenthcomponent and afterward of a fourth row to a seventh row of the matrix mis a vector {(m_(1,1),m_(1,2), . . . ,m_(1,n)), (m_(2,1),m_(2,2), . . .,m_(2,n)), . . . } representing a linearly-independent linear dependencerelation Σ_(i) ⁷m_(ji)v_(i)=0(j=1,2, . . .) of all of the seven12-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, and v₇ that were input.The linear-relation derivation section 34 outputs a vectorm₁=(982,226,146,1,0,0,0) that is composed of the thirteenth componentand afterward of the fourth row of the matrix m, a vectorm₂=(53,941,915,0,1,0,0) that is composed of the thirteenth component andafterward of the fifth row of the matrix m, and a vectorm₃=(394,852,48,0,0,1,0) that is composed of the thirteenth component andafterward of the sixth row of the matrix m, and a vectorm₄=(382,194,908,0,0,0,1) that is composed of the thirteenth componentand afterward of the seventh row of the matrix m.

[0250] Now return to the explanation of the process of the second idealreduction section 13 in the basis construction section 33. Next, thesecond ideal reduction section 13 makes a reference to a table 37 for aGroebner basis construction of FIG. 7, and retrieves a record, of whichthe value of the order field is said value d=3, and in which a vector ofwhich the components that correspond to all component numbers describedin the component number list field are all zero does not lie in saidplurality of said vectors m₁=(982,226,146,1,0,0,0),m₂=(53,941,915,0,1,0,0), m₃=(394,852,48,0,0,1,0), andm₄=(382,194,908,0,0,0,1). The value of the order field of a fourteenthrecord is 3, and a vector, of which the component that correspond to thecomponent number lists 4, 5, 6, and 7 of the fourteenth record are allzero, does not lie in the vectors m₁, m₂, m₃, and m₄, whereby thefourteenth record is obtained as a retrieval result.

[0251] Furthermore, the value of the first vector type of the fourteenthrecord is (*,*,*,1,0,0,0)(A code * is interpreted as representing anynumber), which coincides with the vector m₁=(982,226,146,1,0,0,0),whereby the vector m₁ is regarded as a column of the coefficient of eachmonomial of the monomial order 1, X, Y, X², XY, Y², and X³of thealgebraic curve parameter file A to generate a polynomialf₁=982+226X+146Y+X².

[0252] Similarly, the value of the second vector type of the fourteenthrecord is (*,*,*,0,1,0,0)(A code * is interpreted as representing anynumber), which coincides with the vector m₂=(53,941,915,0,1,0,0),whereby the vector m₂ is regarded as a column of the coefficient of eachmonomial of the monomial order 1, X, Y, X², XY, Y², and X³ of thealgebraic curve parameter file A to generate a polynomialf₂=53+941X+915Y+XY.

[0253] Similarly, the value of the third vector type of the fourteenrecord is (*,*,*,0,0,1,0)(A code * is interpreted as representing anynumber), which coincides with the vector m₃=(394,852,48,0,0,1,0),whereby the vector m₃ is regarded as a column of the coefficient of eachmonomial of the monomial order 1, X, Y, X², XY, Y², and X³ of thealgebraic curve parameter file A to generate a polynomialf₃=394+852X+48Y+Y². Finally, the ideal reduction section 13 constructs aset J**={f₁=982+226X+146Y+X², f₂=53+941X+915Y+XY,f₃=394+852X+48Y+Y²} ofthe polynomial output it. Above, the operation of the second idealreduction section 13 is finished.

[0254] Finally, in the Jacobian group element adder of FIG. 1, theGroebner basis J**={982+226X+146Y+X², 53+941X+915Y+XY,394+852X+48Y+Y²},which the second ideal reduction section 13 output, is output from anoutput apparatus.

[0255] Next, the embodiment of the case will be shown in which the C₂₇curve was employed. In this embodiment, the algebraic curve parameterfile of FIG. 8 is employed as an algebraic curve parameter file, theideal type table of FIG. 9 as an ideal type table, the monomial listtable of FIG. 10 as an monomial list table, and the table for a Groebnerbasis construction of FIG. 11 as a table for a Groebner basisconstruction respectively.

[0256] In the Jacobian group element adder of FIG. 1, suppose Groebnerbases I₁={689+623X+130X²+X³,568+590X+971X²+Y}

[0257] and I₂={689+623X+130X²+X³, 568+590X+971X²+Y}

[0258] were input of the ideal of the coordinate ring of the algebraiccurve designated by the algebraic curve parameter file A, whichrepresents an element of the Jacobian group of the C₂₇ curve designatedby the algebraic curve parameter file A 16 and the algebraic curveparameter file A of FIG. 8.

[0259] At first, an ideal composition section 11, which takes thealgebraic curve parameter file A of FIG. 8, and the above-mentionedGroebner bases I₁ and I₂ as an input, operates as follows according to aflow of the process of the functional block shown in FIG. 2. At first,the ideal composition section 11 makes a reference to the ideal typetable of FIG. 9 in the ideal type classification section 21 of FIG. 2,retrieves a record in which the ideal type described in the ideal typefield accords with the type of the input ideal I₁ for obtaining aneleventh record, and acquires a value N₁=31 of the ideal type numberfield and a value d₁=3 of the order field of the eleventh record.Similarly, the ideal composition section 11 retrieves a record in whichthe ideal type accords with the type of the input ideal I₂ for obtainingthe eleventh record, and acquires a value N₂=31 of the ideal type numberfield and a value d₂=3 of the order field of the eleventh record.

[0260] Next, the ideal composition section 11 calculates the sumd₃=d₁+d₂=6 of said values d₁=3 and d₂=3 of said order field in themonomial vector generation section 22, makes a reference to the monomiallist table, retrieves a record of which the value of the order field issaid d₃=6 for obtaining a first record, and acquires a list 1, X, X²,X³, Y, X⁴, XY, X⁵, X²Y, and X⁶ of the monomial described in the monomiallist field of the first record. I₁ and I₂ are equivalent, whereby aremainder to be attained by dividing M_(i) by I₁ for each ofM_(i)(1<=i<=10) in said list 1, X, X², X³, Y, X⁴, XY, X⁵, X²Y, and X⁶ ofsaid monomial is calculated to obtain a polynomial a^((i)) ₁+a^((i))₂X+a^((i)) ₃X², to arrange its coefficients in order of the monomialorder 1, X, X², . . . of the algebraic curve parameter file A, and togenerate a vector w^((i)) ₁=(a^((i)) ₁,a^((i)) ₂,a^((i)) ₃).

[0261] Furthermore, the ideal composition section 11 regards acoefficient list 0, 7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, and 1 described inthe algebraic curve parameter file A of FIG. 8 as a coefficient row ofeach monomial of the monomial order 1, X, X², X³, Y, X⁴, XY, X⁵, X²Y,X^(6,) X³Y, X⁷, and Y² described in the algebraic curve parameter file Aof FIG. 8, constructs a defining polynomial F=Y²+X⁷+7X, when adifferential of a polynomial M with respect to its X is expressed byD_(X)(M), and a differential of a polynomial M with respect to its Y isexpressed by D_(Y)(M), calculates a remainder to be attained by dividinga polynomial D_(X)(M_(i))D_(Y)(F)−D_(Y)(M_(i))D_(X)(F) by I₁, obtains apolynomial b^((i)) ₁+b^((i)) ₂X+b^((i)) ₃X², arranges its coefficientsin order of the monomial order 1, X, X², . . . of the algebraic curveparameter file A, generates a vector w^((i)) ₂=(b^((i)) ₁,b^((i))₂,b^((i)) ₃), and connect the above-mentioned two vectors w^((i)) ₁ andw^((i)) ₂ for generating a vector v_(i)=(a^((i)) ₁,a^((i)) ₂,b^((i))₁,b^((i)) ₂,b^((i)) ₃). That is, divide M₁=1 by I₁: then1=0·(689+623X+130X²+X³)+0·(568+590X+971X²+Y)+1,

[0262] whereby, 1 is obtained as a remainder to generate a vectorw⁽1)₁=(1,0,0). Furthermore, divide D_(X)(1)D_(Y)(F)−D_(Y)(1)D_(X)(F)=0by I₁: then 0, whereby 0 is obtained as a remainder to generate a vectorw⁽¹⁾ ₂=(0,0,0). w⁽¹⁾ ₁ and w⁽¹⁾ ₂ are connected to generate a vectorv₁=(1,0,0,0,0,0).

[0263] Next, divide M₂=X by I₁: thenX=0·(689+623X+130X²+X³)+0·(568+590X+971X²+Y)+X, whereby, X is obtainedas a remainder to generate a vector w⁽²⁾ ₁=(0,1,0). Furthermore, divideD_(X)(X)D_(Y)(F)−D_(Y)(X)D_(X)(F)=D_(Y)(F)=2Y by I₁: then2Y=0·(689+623X+130X²+X³)+2(568+590X+971X²+Y)+882+838X+76X², whereby882+838X+76X² is obtained as a remainder to generate a vector w⁽²⁾₂=(882,838,76). w⁽²⁾ ₁ and w⁽²⁾ ₂ are connected to generate a vectorv₂=(0,1,0,882,838,76)

[0264] Next, divide M₃=X² by I₁: thenX²=0·(689+623X+130X²+X³)+0·(568+590X+971X²+Y)+X², whereby, X² isobtained as a remainder to generate a vector w⁽³⁾ ₁=(0,0,1).Furthermore, divide D_(X)(X²)D_(Y)(F)−D_(Y)(X²)D_(X)(F)=4XY by I₁: then4XY=152(689+623X+130X²+X³)+4X(568+590X+971X²+Y)+208+905X+78X², whereby208+905X+78X² is obtained as a remainder to generate a vector w⁽³⁾₂=(208,905,78). w⁽³⁾ ₁ and w⁽³⁾ ₂ are connected to generate a vectorv₃=(0,0,1,208,905,78).

[0265] Next, divide M₄=X³ by I₁: thenX³=1·(689+623X+130X²+X³)+0·(568+590X+971X 2+Y)+320+386X+879X², whereby,320+386X+879X² is obtained as a remainder to generate a vector w⁽⁴⁾₁=(320,386,879). Furthermore, divideD_(X)(X³)D_(Y)(F)−D_(Y)(X³)D_(X)(F)=6X²Y by I₁: then 6X2Y=(117+228X)(689+623X+130X²+X³)+6X²(568+590X+971X²+Y)+107+69X+778X²,whereby 107+69X+778X² is obtained as a remainder to generate a vectorw⁽⁴⁾ ₂=(107,69,778). w⁽⁴⁾ ₁ and w⁽⁴⁾ ₂ are connected to generate avector v₄=(320,386,879,107,69,778)

[0266] Next, divide M₅=Y by I₁: thenY=0·(689+623X+130X²+X³)+1·(568+590X+971X²+Y)+441+419X+38X², whereby,441+419X+38X² is obtained as a remainder to generate a vector w⁽⁵⁾₁=(441,419,38). Furthermore, divideD_(X)(Y)D_(Y)(F)−D_(Y)(Y)D_(X)(F)=−D_(X)(F)=1002+1002X⁶ by I₁, then1002+1002X⁶=(865+78X+910X²+1002X³)(689+623X+130X²+X³)+0·(568+590X+971X²+Y)+327+655X+1004X , whereby327+655X+1004X² is obtained as a remainder to generate a vector w⁽⁵⁾₂=(327,655,1004). w⁽⁵⁾ ₁ and w⁽⁵⁾ ₂ are connected to generate a vectorv₅=(441,419,38,327,655,1004).

[0267] Next, divide M₆=X⁴ by I₁: thenX⁴=(879+X)(689+623X+130X²+X³)+0·(568+590X+971X²+Y)+778+590X+133X²,whereby, 778+590X+133X² is obtained as a remainder to generate a vectorw⁽⁶⁾ ₁=(778,590,133). Furthermore, divide D_(X)(X⁴)D_(Y)(F)−D_(Y)(X⁴)D_(X)(F)=8X³Y by I₁: then8X³Y=(200+840X+8Y)(689+623X+130X²+X³)+(542+61X+978X²)(568+590X+971X²+Y)+322+653X+781X², whereby 322+653X+781X² is obtained asa remainder to generate a vector w⁽⁶⁾ ₂=(322,653,781). w⁽⁶⁾ ₁ and w⁽⁶⁾ ₂are connected to generate a vector v₆=(778,590,133,322,653,781).

[0268] Next, divide M₇=XY by I₁: thenXY=38(689+623X+130X²+X³)+X(568+590X+971X²+Y)+52+983X+524X², whereby,52+983X+524X² is obtained as a remainder to generate a vector w⁽⁷⁾₁=(52,983,524). Furthermore, divideD_(X)(XY)D_(Y)(F)−D_(Y)(XY)D_(X)(F)=1002X+1002X⁷+2Y² by I₁, then1002X+1002X⁷+2Y²=(24+726X+78X²+910X³+1002X⁴)(689+623X+130X²+X³)+(882+838X+76X²+2Y)(568+590X+971X²+Y)+105+954X+813X², whereby 105+954X+813X² is obtained asa remainder to generate a vector w⁽⁷⁾ ₂=(105,954,813). w⁽⁷⁾ ₁ and w⁽⁷⁾ ₂are connected to generate a vector v₇=(52,983,524,105,954,813).

[0269] Next, divide M₈=X⁵ by I₁: then X⁵=(133+879X+X²)(689+623X+130X²+X³)+0·(568+590X+971X²+Y)+182+657X+453X², whereby,182+657X+453X² is obtained as a remainder to generate a vector w⁽⁸⁾₁=(182,657,453). Furthermore, divideD_(X)(X⁵)D_(Y)(F)−D_(Y)(X⁵)D_(X)(F)=10X⁴Y by I₁: then10X⁴Y=(912+90X+718Y+10XY)(689+623X+130X²+X³)+(717+855X+321X²)(568+590X+971X²+Y)+619+878X+281X²,whereby 619+878X+281X² is obtained as a remainder to generate a vectorw⁽⁸⁾ ₂=(619,878,281). w⁽⁸⁾ ₁ and w⁽⁸⁾ ₂ are connected to generate avector v₈=(182,657,453,619,878,281).

[0270] Next, divide M₉=X²Y by I₁: then X²Y=(524+38X)(689+623X+130X²+X³)+X² (568+590X+971X²+Y)+186+516X+466X², whereby,186+516X+466X² is obtained as a remainder to generate a vector w⁽⁹⁾₁=(186,516,466) Furthermore, divide D_(X)(X²Y) D_(Y)(F)−Dy(X²Y)D_(X)(F)=1002X²+1002X⁸+4XY² by I₁: then1002X²⁺¹⁰⁰²X⁸+4XY²=(892+941X+865X²+78X³+910X⁴+1002X⁵+152Y)(689+623X+130X²+X³)+(208+905X+78X²+4XY)(568+590X+971X²+Y)+811+600X+123X², whereby 811+600X+123X² is obtained asa remainder to generate a vector w⁽⁹⁾ ₂=(811,600,123). w⁽⁹⁾ ₁ and w⁽⁹⁾ ₂are connected to generate a vector v₉=(186,516,466,811,600,123).

[0271] Next, divide M₁₀=X⁶ by I₁: then X⁶=(453+133X+879X²+X³)(689+623X+130X²+X³)+0·(568+590X+971X²+Y)+673+483X+289X², whereby,673+483X+289X² is obtained as a remainder to generate a vector w⁽¹⁰⁾₁=(673,483,289). Furthermore, divide D_(X)(X⁶)D_(Y)(F)−D_(Y)(X⁶)D_(X)(F)=12X⁵Y by I₁: then 12X⁵Y=(985+732X+587Y+458XY+12X²Y)(689+623X+130X²+X³)+(166+821X+391X²) (568+590X+971X²+Y)+950+741X+201X²,whereby 950+741X+201X² is obtained as a remainder to generate a vectorw⁽¹⁰⁾ ₂=(950,741,201). w⁽¹⁰⁾ ₁ and w⁽¹⁰⁾ ₂ are connected to generate avector v₁₀=(673,483,289,950,741,201). Above, the process of the idealcomposition section 11 in the monomial vector generation section 22 isfinished.

[0272] Next, in the basis construction section 23, the ideal compositionsection 11 inputs ten six-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆,v₇, v₆, v₉, and, v₁₀ generated in the monomial vector generation section22 into the linear-relation derivation section 24, and obtains aplurality of 10-dimensional vectors m₁,m₂, . . . as an output. Thelinear-relation derivation section 24 derives a linear relation of thevectors, which were input, employing the discharging method. Thedischarging method belongs to a known art, whereby, as to an operationof the linear-relation derivation section 24, only its outline is shownbelow. The linear-relation derivation section 24 firstly arranges theten six-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, v₇, v₈, v₉, and, v₁₀which were input, in order for constructing a 10×6 matrix$\begin{matrix}{M_{C} = \begin{pmatrix}1 & 0 & 0 & 0 & 0 & 0 \\0 & 1 & 0 & 882 & 838 & 76 \\0 & 0 & 1 & 208 & 905 & 78 \\320 & 386 & 879 & 107 & 69 & 778 \\441 & 419 & 38 & 327 & 655 & 1004 \\778 & 590 & 133 & 322 & 653 & 781 \\52 & 983 & 524 & 105 & 954 & 813 \\182 & 657 & 453 & 619 & 878 & 281 \\186 & 516 & 466 & 811 & 600 & 123 \\673 & 483 & 289 & 950 & 741 & 201\end{pmatrix}} & \left\lbrack {E\quad {Q.\quad 20}} \right\rbrack\end{matrix}$

[0273] Next, the linear-relation derivation section 24 connects a10-dimensional unity matrix to the matrix M_(c) to obtain$\begin{matrix}{M_{C}^{\prime} = \begin{pmatrix}1 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\0 & 1 & 0 & 882 & 838 & 76 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\0 & 0 & 1 & 208 & 905 & 78 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\320 & 386 & 879 & 107 & 69 & 778 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\441 & 419 & 38 & 327 & 655 & 1004 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 \\778 & 590 & 133 & 322 & 653 & 781 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 \\52 & 983 & 524 & 105 & 954 & 813 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 \\182 & 657 & 453 & 619 & 878 & 281 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 \\186 & 516 & 466 & 811 & 600 & 123 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 \\673 & 483 & 289 & 950 & 741 & 201 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1\end{pmatrix}} & \left\lbrack {E\quad {Q.\quad 21}} \right\rbrack\end{matrix}$

[0274] Next, the linear-relation derivation section 24 triangulates amatrix M′_(c) by adding a constant multiple of an i-th row to an(i+1)-th row (i=1,2, . . . ,6) to a tenth row to obtain the following amatrix m. $\begin{matrix}{m = \begin{pmatrix}1 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\0 & 1 & 0 & 882 & 838 & 76 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\0 & 0 & 1 & 208 & 905 & 78 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\0 & 0 & 0 & 494 & 87 & 753 & 689 & 623 & 130 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\0 & 0 & 0 & 0 & 477 & 924 & 591 & 170 & 804 & 22 & 1 & 0 & 0 & 0 & 0 & 0 \\0 & 0 & 0 & 0 & 0 & 475 & 742 & 22 & 242 & 149 & 314 & 1 & 0 & 0 & 0 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 699 & 601 & 688 & 281 & 217 & 287 & 1 & 0 & 0 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 193 & 959 & 364 & 180 & 550 & 43 & 0 & 1 & 0 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 780 & 667 & 96 & 50 & 897 & 327 & 0 & 0 & 1 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 761 & 727 & 417 & 523 & 278 & 912 & 0 & 0 & 0 & 1\end{pmatrix}} & \left\lbrack {{EQ}{.22}} \right\rbrack\end{matrix}$

[0275] As well known, the vector that is composed of a seventh componentand afterward of a seventh row to a tenth row of the matrix m is avector {(m_(1,1),m_(1,2), . . . ,m_(1,n)), m_(2,1),m_(2,2), . . .,m_(2,n)), . . . } representing a linearly-independent linear dependencerelation Σ_(i) ¹⁰m_(ji)v_(i)=0(j=1,2, . . .) of all of the tensix-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, v₇, v₈, v₉, and, v₁₀that were input. The linear-relation derivation section 24 outputs avector m₁=(699,601,688,281,217,287,1,0,0,0) that is composed of theseventh component and afterward of the seventh row of the matrix m, avector m₂=(193,959,364,180,550,43,0,1,0,0) that is composed of theseventh component and afterward of the eighth row of the matrix m, and avector m₃=(780,667,96,50,897,327,0,0,1,0) that is composed of theseventh component and afterward of the ninth row of the matrix m, and avector m₄=(761,727,417,523,278,912,0,0,0,1) that is composed of theseventh component and afterward of the tenth row of the matrix m. Nowreturn to the explanation of the process of the ideal compositionsection 11 in the basis construction section 23.

[0276] Next, the ideal composition section 11 makes a reference to thetable for a Groebner basis construction of FIG. 11, and retrieves arecord, of which the value of the order field is said value d₃=6, and inwhich a vector of which the components that correspond to all componentnumbers described in the component number list field are all zero doesnot lie in said plurality of said vectorsm₁=(699,601,688,281,217,287,1,0,0,0),m₂=(193,959,364,180,550,43,0,1,0,0), m₃=(780,667,96,50,897,327,0,0,1,0),and m₄=(761,727,417,523,278,912,0,0,0,1). The value of the order fieldof the first record is 6, and a vector, of which the componentscorrespond to the component number lists 7, 8, 9, and 10 of a firstrecord are all zero, does not lie in the vectors m₁, m₂, m₃, and m₄,whereby the first record is obtained as a retrieval result.

[0277] Furthermore, the value of the first vector type of the firstrecord is (*,*,*,*,*,*,1,0,0,0)(A code * is interpreted as representingany number), which coincides with the vectorm₁=(699,601,688,281,217,287,1,0,0,0), whereby the vector m₁ is regardedas a column of the coefficient of each monomial of the monomial order 1,X, X², X³, Y, X⁴, XY, X⁵, X²Y, and X⁶ of the algebraic curve parameterfile A to generate a polynomial f₁=699+601X+688X²+281X³+217Y+287X⁴+XY.

[0278] Similarly, the value of the second vector type of the firstrecord is (*,*,*,*,*,*,0,1,0,0)(A code * is interpreted as representingany number), which coincides with the vectorm₂=(193,959,364,180,550,43,0,1,0,0), whereby the vector m₂ is regardedas a column of the coefficient of each monomial of the monomial order 1,X, X², X³, Y, X⁴, XY, X⁵, X²Y, and X⁶ of the algebraic curve parameterfile A to generate a polynomial f₂=193+959X+364X²+180X³+550Y+43X⁴+X⁵.The value of third vector type of the first record is null, whereby itis neglected. Finally, the ideal composition section 11 constructs a setJ={f₁,f₂}={699+601X+688X²+281X³+217Y+287X⁴+XY,193+959X+364X²+180X³+550Y+43X⁴+X⁵}of the polynomial to output it. Above, the operation of the idealcomposition section 11 is finished.

[0279] Next, the first ideal reduction section 12, which takes as aninput the algebraic curve parameter file A of FIG. 8, and the Groebnerbasis J={699+601X+688X²+281X³+217Y+287X⁴+XY,193+959X+364X²+180X³+550Y+43X⁴X⁵} that the ideal composition section 11output, operates as follows according to a flow of the process of thefunctional block shown in FIG. 3.

[0280] At first, in the ideal type classification section 31 of FIG. 3,the ideal reduction section 12 makes a reference to the ideal type tableof FIG. 9, retrieves a record in which the ideal type described in theideal type field accords with the type of the input ideal J forobtaining a first record, and acquires a value N=61 of the ideal typenumber field and a value d=3 of the reduction order field of the firstrecord. Next, the ideal reduction section 12 confirms that said valued=3 is not zero, makes a reference to the monomial list table of FIG. 10in the polynomial vector generation section 32, retrieves a record ofwhich the value of the order field is said d=3 for obtaining a fourthrecord, and acquires a list 1, X, X², X³, Y, X⁴, and XY of the monomialdescribed in the monomial list field of the fourth record.

[0281] Furthermore, the ideal reduction section 12 acquires a firstelement f=699+601X+688X²+281X³+217Y+284X⁴+XY of J, and a second elementg=193+959X+364X²+180X³+550Y+43X⁴+X⁵(A third element does not lie in J,whereby a third polynomial h is not employed), regards a coefficientlist 0,7,0,0,0,0,0,0,0,0,0,1,1 of the algebraic curve parameter file Aas a column of the coefficient of each monomial of the monomial order 1,X, X², X³, Y, X⁴, XY, X⁵, X²Y, X⁶, X³Y, X and Y² of the algebraic curveparameter file A, and generates a defining polynomial F=Y²+X⁷+7X.

[0282] Next, for each of M_(i)(1<=i<=7) in said list 1, X, X², X³, Y, X⁴and XY of said monomial, the ideal reduction section 12 calculates aremainder equation r_(i) of a product Mi·g of M_(i) and the polynomial gby the polynomials f and F, arranges its coefficients in order of themonomial order 1,X, X², X³, Y, X⁴, XY, X⁵, X²Y, X⁶, X³Y, and X⁷ of thealgebraic curve parameter file A, and generates a vector v_(i). That is,at first, for a first monomial M₁=1, divide1·g=193+959X+364X²+180X³+550Y+43X⁴+X⁵ byf=699+601X+688X²+281X³+217Y+287X⁴+XY and F=Y²+X⁷+7X: theng=0·f+0·F+193+959X+364X²+180X³+550Y+43X⁴+X⁵, whereby a remainder193+959X+364X²+180X³+550Y+43X⁴+X⁵ is obtained to generate a vectorv₁=(193,959,364,180,550,43,0,1,0,0,0,0).

[0283] Next, for a second monomial M₂=X, divideXg=X(193+959X+364X²+180X³+550Y+43X⁴+X⁵) byf=699+601X+688X²+281X³+217Y+287X⁴+XY and F=Y²+X⁷+7X: thenXg=550f+0·F+988+595X+934X²+191X³+743X⁴+43X⁵+X⁶+721Y, whereby a remainder988+595X+934X²+191X³+743X⁴+43X⁵+X⁶+721Y is obtained to generate a vectorv₂=(988,595,934,191,721,743,0,43,0,1,0,0).

[0284] Next, for a third monomial M₃=X², divideX²g=X²(193+959X+364X²+180X³+550Y+43X⁴+X⁵) byf=699+601X+688X²+281X³+217Y+287X⁴+XY and F=Y²+X⁷+7X: thenX²g=(721+550X)f+0·F+521+528Y+975X²+133X³+109X⁴+743X⁵+43X⁶+X⁷+947Y,whereby a remainder 521+528X+975X²+133X³+109X⁴+743X⁵+43X⁶+X⁷+947Y isobtained to generate a vectorv₃=(521,528,975,133,947,109,0,743,0,43,0,1).

[0285] Next, for a fourth monomial M₄=X³, divideX³g=X³(193+959X+364X²+180X³+550Y+43X⁴+X⁵) byf=699+601X+688X²+281X³+217Y+287X⁴+XY and F=Y²+X⁷+7X: thenX³g=(200+969X+101X²+287X³+1008Y)f+(217+X)F+451+78X+481X²+791X³+389X⁴+924X⁵+527X⁶+195X⁷+686Y,whereby a remainder 451+78X+481X²+791X³+389X⁴+924X⁵+527X⁶+195X⁷+686Y isobtained to generate a vectorv₄=(451,78,481,791,686,389,0,924,0,527,0,195).

[0286] Next, for a fifth monomial M₅=Y, divideYg=Y(193+959X+364X²+180X³+550Y+43X⁴+X⁵) byf=699+601X+688X²+281X³+217Y+287X⁴+XY and F=Y²+X⁷+7X: thenYg=(884+712X+316X²+195X³+X⁴+287Y)f+(829+722X)F+601+459X+217X²+14X³+965X⁴+924X⁵+130X⁶+438X⁷+253Y,whereby a remainder 601+459X+217X²+14X³+965X⁴+924X⁵+130X⁶+438X⁷+253Y isobtained to generate a vectorv₅=(601,459,217,14,253,965,0,924,0,130,0,438).

[0287] Next, for a sixth monomial M₆=X⁴, divideX⁴g=X⁴(193+959X+364X²+180X³+550Y+43X⁴+X⁵) byf=699+601X+688X²+281X³+217Y+287X⁴+XY and F=Y²+X⁷+7X: thenX⁴g=(317+128X+188X²+571X³+287X⁴+814Y+1008XY)f+(946+412X+X²)F+397+954X+514X²+891X³+255X⁴+901X⁵+173X⁶+906X⁷+922Y,whereby a remainder 397+954X+514X²+891X³+255X⁴+901X⁵+173X⁶+906X⁷+922Y isobtained to generate a vectorv₆=(397,954,514,891,922,255,0,901,0,173,0,906).

[0288] Finally, for a seventh monomial M₇=XY, divideXYg=XY(193+959X+364X²+180X³+550Y+43X⁴+X⁵) byf=699+601X+688X²+281X³+217Y+287X⁴+XY and F=Y²+X⁷+7X: thenXYg=(992+536X+805X²+906X³+195X⁴+X⁵+571Y+287XY)f+(200+258X+722X²)F+784+420X+871X²+113X³+933X⁴+749X⁵+153X⁶+112X⁷+88Y,whereby a remainder 784+420X+871X²+113X³+933X⁴+749X⁵+153X⁶+112X⁷+88isobtained to generate a vectorv₇=(784,420,871,113,88,933,0,749,0,153,0,112). Above, the process of thesecond ideal reduction section 12 in the polynomial vector generationsection 32 is finished.

[0289] Next, in the basis construction section 33, the second idealreduction section 12 inputs seven 12-dimensional vectors v₁, v₂, v₃, v₄,v₅, v₆, and v₇ generated in the polynomial vector generation section 32into the linear-relation derivation section 34, and obtains a pluralityof seven-dimensional vectors m₁, m₂, . . . as an output.

[0290] The linear-relation derivation section 34 derives a linearrelation of the vectors, which were input, employing the dischargingmethod. The discharging method belongs to a known art, whereby, as to anoperation of the linear-relation derivation section 34, only its outlineis shown below. The linear-relation derivation section 34 firstlyarranges the seven 12-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, andv₇, which were input, in order for constructing a 7×12 matrix$\begin{matrix}{M_{R} = \begin{pmatrix}193 & 959 & 364 & 180 & 550 & 43 & 0 & 1 & 0 & 0 & 0 & 0 \\988 & 595 & 934 & 191 & 721 & 743 & 0 & 43 & 0 & 1 & 0 & 0 \\521 & 528 & 975 & 133 & 947 & 109 & 0 & 743 & 0 & 43 & 0 & 1 \\451 & 78 & 481 & 791 & 686 & 389 & 0 & 924 & 0 & 527 & 0 & 195 \\601 & 459 & 217 & 14 & 253 & 965 & 0 & 924 & 0 & 130 & 0 & 438 \\397 & 954 & 514 & 891 & 922 & 255 & 0 & 901 & 0 & 173 & 0 & 906 \\784 & 420 & 871 & 113 & 88 & 933 & 0 & 749 & 0 & 153 & 0 & 112\end{pmatrix}} & \left\lbrack {{EQ}.\quad 23} \right\rbrack\end{matrix}$

[0291] Next, the linear-relation derivation section 34 connects aseven-dimensional unity matrix to the matrix M_(R) to construct$\begin{matrix}{M_{R}^{\prime} = \begin{pmatrix}193 & 959 & 364 & 180 & 550 & 43 & 0 & 1 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\988 & 595 & 934 & 191 & 721 & 743 & 0 & 43 & 0 & 1 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 \\521 & 528 & 975 & 133 & 947 & 109 & 0 & 743 & 0 & 43 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 & 0 \\451 & 78 & 481 & 791 & 686 & 389 & 0 & 924 & 0 & 527 & 0 & 195 & 0 & 0 & 0 & 1 & 0 & 0 & 0 \\601 & 459 & 217 & 14 & 253 & 965 & 0 & 924 & 0 & 130 & 0 & 438 & 0 & 0 & 0 & 0 & 1 & 0 & 0 \\397 & 954 & 514 & 891 & 922 & 255 & 0 & 901 & 0 & 173 & 0 & 906 & 0 & 0 & 0 & 0 & 0 & 1 & 0 \\784 & 420 & 871 & 113 & 88 & 933 & 0 & 749 & 0 & 153 & 0 & 112 & 0 & 0 & 0 & 0 & 0 & 0 & 1\end{pmatrix}} & \left\lbrack {{EQ}.\quad 24} \right\rbrack\end{matrix}$

[0292] Next, the linear-relation derivation section 34 triangulates amatrix M′_(R) by adding a constant multiple of an i-th row to an(i+1)-th row (i=1,2,3) to a seventh row to obtain the following a matrixm. $\begin{matrix}{m = \begin{pmatrix}193 & 959 & 364 & 180 & 550 & 43 & 0 & 1 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\0 & 485 & 524 & 587 & 922 & 434 & 0 & 247 & 0 & 1 & 0 & 0 & 204 & 1 & 0 & 0 & 0 & 0 & 0 \\0 & 0 & 362 & 736 & 914 & 919 & 0 & 822 & 0 & 725 & 0 & 1 & 14 & 682 & 1 & 0 & 0 & 0 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 804 & 795 & 814 & 1 & 0 & 0 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 522 & 542 & 571 & 0 & 1 & 0 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 385 & 443 & 103 & 0 & 0 & 1 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 12 & 627 & 897 & 0 & 0 & 0 & 1\end{pmatrix}} & \left\lbrack {{EQ}.\quad 25} \right\rbrack\end{matrix}$

[0293] As well known, the vector that is composed of a thirteenthcomponent and afterward of a fourth row to a seventh row of the matrix mis a vector {(m_(1,1),m_(1,2), . . . ,m_(1,7)), (m_(2,1),m_(2,2), . . .,m_(2,7)), . . . } representing a linearly-independent linear dependencerelation Σ_(i=1) ⁷m_(ji)v_(i)=0(j=1,2, . . .) of all of the seven12-dimensional vectors v₁, v₂, v₃, v₄, v_(5,) v₆, and v₇ that wereinput. The linear-relation derivation section 34 outputs a vectorm₁=(804,795,814,1,0,0,0) that is composed of the thirteen component andafterward of the fourth row of the matrix m, a vectorm₂=(522,542,571,0,1,0,0) that is composed of the thirteenth componentand afterward of the fifth row of the matrix m, and a vectorm₃=(385,443,103,0,0,1,0) that is composed of the thirteenth componentand afterward of the sixth row of the matrix m, and a vectorm₄=(12,627,897,0,0,0,1) that is composed of the thirteen component andafterward of the seventh row of the matrix m.

[0294] Now return to the explanation of the process of the first idealreduction section 12 in the basis construction section 33. Next, thissecond ideal reduction section 12 makes a reference to the table for aGroebner basis construction of FIG. 11, retrieves a record of which thevalue of the order field is said value d=3, and in which a vector ofwhich the components that correspond to all component numbers describedin the component number list field are all zero does not lie in saidplurality of said vectors m₁=(804,795,814,1,0,0,0),m₂=(522,542,571,0,1,0,0), m₃=(385,443,103,0,0,1,0), andm₄=(12,627,897,0,0,0,1). The value of the order field of an eleventhrecord is 3, and a vector, of which the components that correspond tothe component number lists 4, 5, 6, and 7 of the eleventh record are allzero, does not lie in the vectors m₁, m₂, m₃, and m₄, whereby theeleventh record is obtained as a retrieval result.

[0295] Furthermore, the value of the first vector type of the eleventhrecord is (*,*,*,1,0,0,0) (A code * is interpreted as representing anynumber), which coincides with the vector m₁=(804,795,814,1,0,0,0),whereby the vector m₁ is regarded as a column of the coefficient of eachmonomial of the monomial order 1, X, X², X³, Y, X⁴, and XY of thealgebraic curve parameter file A to generate a polynomialf₁=804+795X+814X²+X³.

[0296] Similarly, the value of the second vector type of the eleventhrecord is (*,*,*,0,1,0,0) (A code * is interpreted as representing anynumber), which coincides with the vector m₂=(522,542,571,0,1,0,0),whereby the vector m₂ is regarded as a column of the coefficient of eachmonomial of the monomial order 1, X, X², X³, Y, X⁴, and XY of thealgebraic curve parameter file A to generate a polynomialf₂=522+542X+571X²+Y. The value of the third vector type of the eleventhrecord is null, whereby it is neglected. Finally, the ideal reductionsection 12 constructs a setJ*={f₁,f₂}={804+795X+814X²+X³,522+542X+571X²+Y} of the polynomial tooutput it. Above, the operation of the first ideal reduction section 12is finished.

[0297] Next, the second ideal reduction section 13, which takes as aninput the algebraic curve parameter file A of FIG. 8, and the Groebnerbasis J*={f₁,f₂, }={804+795X+814X²+X³, 522+542X+571X²+Y} that the firstideal reduction section 12 output, operates as follows according to aflow of the process of the functional block shown in FIG. 3. At first,the ideal reduction section 13 makes a reference to the ideal type tableof FIG. 9 in the ideal type classification section 31 of FIG. 3,retrieves a record in which the ideal type described in the ideal typefield accords with the type of the input ideal J* for obtaining aneleventh record, and acquires a value N=31 of the ideal type numberfield and a value d=3 of the reduction order field of the eleventhrecord.

[0298] Next, the ideal reduction section 13 confirms that said value d=3is not zero, makes a reference to the monomial list table of FIG. 10 inthe polynomial vector generation section 32, retrieves a record of whichthe value of the order field is said d=3 for obtaining a fourth record,and acquires a list 1, X, X², X³, Y, X⁴, and XY of the monomialdescribed in the monomial list field of the fourth record. Furthermore,the ideal reduction section 13 acquires a first elementf=804+795X+814X²+X³, and a second element g=522+542X+571X²+Y of J* (Athird element does not lie in J*, whereby a third polynomial h is notemployed), regards a coefficient list 0, 7, 0, 0, 0, 0, 0, 0, 0, 0, 0,1, and 1 of the algebraic curve parameter file A as a column of thecoefficient of each monomial of the monomial order 1, X, X², X³, Y, X⁴,XY, X⁵, X²Y, X⁶, X³Y, X⁷ and Y² of the algebraic curve parameter file A,and generates a defining polynomial F=Y²+X⁷+7X.

[0299] Next, for each of M_(i)(1<=i<=7) in said list 1, X, X², X³, Y, X⁴and XY of said monomial, the ideal reduction section 13 calculates aremainder equation r_(i) of a product M_(i)·g of M_(i) and thepolynomial g by the polynomials f and F, arranges its coefficients inorder of the monomial order 1, X, X², X³, Y, X⁴, XY, X⁵, X²Y, X⁶, X³Y,and X⁷ of the algebraic curve parameter file A, and generates a vectorv_(i). That is, at first, for a first monomial M₁=1, divide1·g=522+542X+571X²+Y by f=804+795X+814X²+X³ and F=Y²+X⁷+7X: theng=0·f+0·F+522+542X+571X²+Y, whereby a remainder 522+542X+571X²+Y isobtained to generate a vector v₁=(522,542,571,0,1,0,0,0,0).

[0300] Next, for a second monomial M₂=X, divide Xg=X(522+542X+571X²+Y)by f=804+795X+814X²+X³ and F=Y²+X⁷+7X: thenXg=571f+0·F+11+627X+897X²+XY, whereby a remainder 11+627X+897X²+XY isobtained to generate a vector v₂=(11,627,897,0,0,0,1,0,0).

[0301] Next, for a third monomial M₃=X², divide X²g=X²(522+542X+571X²+Y)by f=804+795X+814X²+X³ and F=Y²+X⁷+7X: thenX²g=(897+571X)f+0·F+247+259X+985X²+X²Y, whereby a remainder247+259X+985X²+X²Y is obtained to generate a vectorv₃=(247,259,985,0,0,0,0,0,1).

[0302] Next, for a fourth monomial M₄=X³, divideX³g=X³(522+542X+571X²+Y) by f=804+795X+814X²+X³ and F=Y²+X⁷+7X: thenX³g=(985+897X+571X²+Y)f+0·F+125+156X+624X²+205Y+214XY+195X²Y, whereby aremainder 125+156X+624X²+205Y+214XY+195X²Y is obtained to generate avector v₄=(125,156,624,0,205,0,214,0,195).

[0303] Next, for a fifth monomial M₅=Y, divide Yg=Y(522+542X+571X²+Y) byf=804+795X+814X²+X³ and F=Y²+X⁷+7X: thenYg=(486+348X+103X²+814X³+1008X⁴)f+1·F+748+780X+665X²+522Y+542XY+571X²Y,whereby a remainder 748+780X+665X²+522Y+542XY+571X²Y is obtained togenerate a vector v₅=(748,780,665,0,522,0,542,0,571).

[0304] Next, for a sixth monomial M₆=X⁴, divide X⁴g=X⁴(522+542X+571X²+Y)by f=804+795X+814X²+X³ and F=Y²+X⁷+7X: thenX⁴g=(624+985X+897X²+571X³+195Y+XY)f+0·F+786+473X+756X²+624Y+566XY+906X²Y,whereby a remainder 786+473X+756X²+624Y+566XY+906X²Y is obtained togenerate a vector v₆=(786,473,756,0,624,0,566,0,906).

[0305] Finally, for a seventh monomial M₇=XY, divideXYg=XY(522+542X+571X²+Y by f=804+795X+814X²+X³ and F=Y2+X⁷+7X: thenXYg=(665+486X+348X²+103X³+814X⁴+1008X⁵+571Y)f+XF+110+789X+294X²+11Y+627XY+897X²Y, whereby a remainder110+789X+294X²+11Y+627XY+897X²Y is obtained to generate a vectorv₇=(110,789,294,0,11,0,627,0,897). Above, the process of the secondideal reduction section 13 in the polynomial vector generation section32 is finished.

[0306] Next, in the basis construction section 33, this ideal reductionsection 13 inputs seven nine-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆,and v₇ generated in the polynomial vector generation section 32 into thelinear-relation derivation section 34, and obtains a plurality ofseven-dimensional vectors m₁, m₂, . . . as an output. Thelinear-relation derivation section 34 derives a linear relation of thevectors, which were input, employing the discharging method. Thedischarging method belongs to a known art, whereby, as to the operationof the linear-relation derivation section 34, only its outline is shownbelow.

[0307] The linear-relation derivation section 34 firstly arranges theseven nine-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, and v₇, whichwere input, in order for constructing a 7×9 matrix $\begin{matrix}{M_{R} = \begin{pmatrix}522 & 542 & 571 & 0 & 1 & 0 & 0 & 0 & 0 \\11 & 627 & 897 & 0 & 0 & 0 & 1 & 0 & 0 \\247 & 259 & 985 & 0 & 0 & 0 & 0 & 0 & 1 \\125 & 156 & 624 & 0 & 205 & 0 & 214 & 0 & 195 \\784 & 780 & 665 & 0 & 522 & 0 & 542 & 0 & 571 \\786 & 473 & 756 & 0 & 624 & 0 & 566 & 0 & 906 \\110 & 789 & 294 & 0 & 11 & 0 & 627 & 0 & 897\end{pmatrix}} & \left\lbrack {{EQ}.\quad 26} \right\rbrack\end{matrix}$

[0308] Next, the linear-relation derivation section 34 connects aseven-dimensional unity matrix to the matrix M_(R) to construct$\begin{matrix}{M_{R}^{\prime} = \begin{pmatrix}522 & 542 & 571 & 0 & 1 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\11 & 627 & 897 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 \\247 & 259 & 985 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 & 0 \\125 & 156 & 624 & 0 & 205 & 0 & 214 & 0 & 195 & 0 & 0 & 0 & 1 & 0 & 0 & 0 \\748 & 780 & 665 & 0 & 522 & 0 & 542 & 0 & 571 & 0 & 0 & 0 & 0 & 1 & 0 & 0 \\786 & 473 & 756 & 0 & 624 & 0 & 566 & 0 & 906 & 0 & 0 & 0 & 0 & 0 & 1 & 0 \\110 & 789 & 294 & 0 & 11 & 0 & 627 & 0 & 897 & 0 & 0 & 0 & 0 & 0 & 0 & 1\end{pmatrix}} & \left\lbrack {{EQ}.\quad 27} \right\rbrack\end{matrix}$

[0309] Next, the linear-relation derivation section 34 triangulates amatrix M′_(R) by adding a constant multiple of an i-th row to an(i+1)-th row (i=1,2,3) to a seventh row to obtain the following matrixm. $\begin{matrix}{m = \begin{pmatrix}522 & 542 & 571 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\0 & 171 & 48 & 0 & 230 & 0 & 1 & 0 & 0 & 230 & 1 & 0 & 0 & 0 & 0 & 0 \\0 & 0 & 976 & 0 & 385 & 0 & 53 & 0 & 1 & 385 & 53 & 1 & 0 & 0 & 0 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 804 & 795 & 814 & 1 & 0 & 0 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 487 & 467 & 438 & 0 & 1 & 0 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 385 & 443 & 103 & 0 & 0 & 1 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 998 & 382 & 112 & 0 & 0 & 0 & 1\end{pmatrix}} & \left\lbrack {{EQ}.\quad 28} \right\rbrack\end{matrix}$

[0310] As well known, the vector that is composed of a tenth componentand afterward of a fourth row to a seventh row of the matrix m is avector {(m_(1,1),m_(1,2), . . . ,m_(1,n)), (m_(2,1),m_(2,2), . . .,m_(2,n)), . . . } representing a linearly-independent linear dependencerelation Σ_(i) ⁷m_(ji)v_(i)=0(j=1,2, . . .) of all of the seven12-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, and v₇ that were input.The linear-relation derivation section 34 outputs a vectorm₁=(804,795,814,1,0,0,0) that is composed of the tenth component andafterward of the fourth row of the matrix m, a vectorm₂=(487,467,438,0,1,0,0) that is composed of the tenth component andafterward of the fifth row of the matrix m, and a vectorm₃=(385,443,103,0,0,1,0) that is composed of the tenth component andafterward of the sixth row of the matrix m, and a vectorm₄=(998,382,112,0,0,0,1) that is composed of the tenth component andafterward of the seventh row of the matrix m.

[0311] Now return to the explanation of the process of the second idealreduction section 13 in the basis construction section 33. Next, thisideal reduction section 13 makes a reference to the table for a Groebnerbasis construction of FIG. 11, retrieves a record, of which the value ofthe order field is said value d=3, and in which a vector of which thecomponents that correspond to all component numbers described in thecomponent number list field are all zero does not lie in said pluralityof said vectors m₁=(804,795,814,1,0,0,0), m₂=(487,467,438,0,1,0,0),m₃=(385,443,103,0,0,1,0), and m₄=(998,382,112,0,0,0,1). The value of theorder field of an eleventh record is 3, and a vector, of which thecomponent number lists 4, 5, 6, and 7 of the eleventh record are allzero, does not lie in the vectors m₁, m₂, m₃, and m₄, whereby theeleventh record is obtained as a retrieval result.

[0312] Furthermore, the value of the first vector type of the eleventhrecord is (*,*,*,1,0,0,0)(A code * is interpreted as representing anynumber), which coincides with the vector m₁=(804,795,814,1,0,0,0),whereby the vector m₁ is regarded as a column of the coefficient of eachmonomial of the monomial order 1, X, X², X³, Y, X⁴, and XY of thealgebraic curve parameter file A to generate a polynomialf₁=804+795X+814X²+X³.

[0313] Similarly, the value of the second vector type of the eleventhrecord is (*,*,*,0,1,0,0)(A code * is interpreted as representing anynumber), which coincides with the vector m₂=(487,467,438,0,1,0,0),whereby the vector m₂ is regarded as a column of the coefficient of eachmonomial of the monomial order 1, X, X², X³, Y, X⁴, and XY of thealgebraic curve parameter file A to generate a polynomialf₂=487+467X+438X²+Y. The value of the third vector type of the eleventhrecord is null, whereby it is neglected.

[0314] Finally, the ideal reduction section 13 constructs a setJ**={f₁,f₂}={804+795X+814X²+X³, 487+467X+438X²+Y} of the polynomial tooutput it. Above, the operation of the second ideal reduction section 13is finished. Finally, in the Jacobian group adder of FIG. 1, theGroebner basis J**={804+795X+814X²+X³,487+467X+438X²+Y}, which the idealreduction section 13 output, is output from the output apparatus.

[0315] Next, the embodiment of the case will be shown in which the C₂₅curve was employed. In this embodiment, the algebraic curve parameterfile of FIG. 12 is employed as an algebraic curve parameter file, theideal type table of FIG. 13 as an ideal type table, the monomial listtable of FIG. 14 as an monomial list table, and the table for a Groebnerbasis construction of FIG. 15 as a table for a Groebner basisconstruction respectively.

[0316] In the Jacobian group element adder of FIG. 1, suppose Groebnerbases I₁={729+88X+X²,475+124X+Y} and I₂={180+422X+X²,989+423X+Y } wereinput of the ideal of the coordinate ring of the algebraic curvedesignated by the algebraic curve parameter file A, which represents anelement of the Jacobian group of the C₂₅ curve designated by thealgebraic curve parameter file A 16 and the algebraic curve parameterfile A of FIG. 12.

[0317] At first, the ideal composition section 11, which takes thealgebraic curve parameter file A of FIG. 12, and the above-mentionedGroebner bases I₁ and I₂ as an input, operates as follows according to aflow of the process of the functional block shown in FIG. 2. The idealcomposition section 11 firstly makes a reference to the ideal type tableof FIG. 13 in the ideal type classification section 21 of FIG. 2,retrieves a record in which the ideal type described in the ideal typefield accords with the type of the input ideal I₁ for obtaining a sixthrecord, and acquires a value N₁=21 of the ideal type number field and avalue d₁=2 of the order field of the sixth record. Similarly, the idealcomposition section 11 retrieves a record in which the ideal typeaccords with the type of the input ideal I₂ for obtaining the sixthrecord, and acquires a value N₂=21 of the ideal type number field and avalue d₂=2 of the order field of the sixth record.

[0318] Next, the ideal composition section 11 calculates the sumd₃=d₁+d₂=4 of said values d₁=2 and d₂=2 of said order field in themonomial vector generation section 22, makes a reference to the monomiallist table of FIG. 14, retrieves a record of which the value of theorder field is said d₃=4 for obtaining the first record, and acquires alist of the monomial 1, X, X², Y, X³, XY, and X⁴ described in themonomial list field of the first record. I₁ and I₂ are different,whereby a remainder to be attained by dividing M_(i) by I₁ for each ofM_(i)(1<=i<=7) in said list 1, X, X², Y, X³, XY, and X⁴ of said monomialis calculated to obtained a polynomial a^((i)) ₁+a^((i)) ₂X, to arrangeits coefficients in order of the monomial order 1, X, . . . of thealgebraic curve parameter file A, and to generate a vector w^((i))₁=(a^((i)) ₁, a^((i)) ₂).

[0319] Furthermore, the ideal composition section 11 calculates aremainder to be attained by dividing M_(i) by I₂, obtains a polynomialb^((i)) ₁+b^((i)) ₂X, arranges its coefficients in order of the monomialorder 1, X, . . . of the algebraic curve parameter file A, generates avector w^((i)) ₂=(b^((i)) ₁,b^((i)) ₂) and connects the above-mentionedtwo vectors w^((i)) ₁ and w^((i)) ₂ for generating a vectorv_(i)=(a^((i)) ₁,a^((i)) ₂,b^((i)) ₁,b^((i)) ₂). That is, divide M₁=1 byI₁: then 1=0·(729+88X+X²)+0·(475+124X+Y)+1, whereby 1 is obtained as aremainder to generate a vector w⁽¹⁾ ₁=(1,0). Furthermore, divide M₁=1 byI₂: then 1=0·(180+422X+X²)+0·(989+423X+Y)+1, whereby 1 is obtained as aremainder to generate a vector w⁽¹⁾ ₂=(1,0). w⁽¹⁾ ₁ and w⁽¹⁾ ₂ areconnected to generate a vector v₁=(1,0,1,0).

[0320] Next, divide M₂=X by I₁: then X=0·(729+88X+X²)+0·(475+124X+Y)+X,whereby, X is obtained as a remainder to generate a vector w⁽²⁾ ₁=(0,1).Furthermore, divide M₂=X by I₂: then X=0·(180+422X+X²)+0·(989+423X+Y)+X,whereby X is obtained as a remainder to generate a vector w⁽²⁾ ₂=(0,1).w⁽²⁾ ₁ and w⁽²⁾ ₂ are connected to generate a vector v₂=(0,1,0,1).

[0321] Next, divide M₃=X² by I₁: thenX²=1·(729+88X+X²)+0·(475+124X+Y)+280+921X, whereby, 280+921X is obtainedas a remainder to generate a vector w⁽³⁾ ₁=(280,921). Furthermore,divide M₃=X² by I₂: then X²=1·(180+422X+X²)+0·(989+423X+Y)+829+587X,whereby 829+587X is obtained as a remainder to generate a vector w⁽³⁾₂=(829,587). w⁽³⁾ ₁ and w⁽³⁾ ₂ are connected to generate a vectorv₃=(280,921,829,587).

[0322] Next, divide M₄=Y by I₁: thenY=0·(729+88X+X²)+1·(475+124X+Y)+534+885X, whereby 534+885X is obtainedas a remainder to generate a vector w⁽⁴⁾ ₁=(534,885). Furthermore,divide M₄=Y by I₂: then Y=0·(180+422X+X²)+1·(989+423X+Y)+20+586X,whereby 20+586X is obtained as a remainder to generate a vector w⁽⁴⁾₂=(20,586). w⁽⁴⁾ ₁ and w⁽⁴⁾ ₂ are connected to generate a vectorv₄=(534,885,20,586).

[0323] Next, divide M₅=X³ by I₁: then X³=(921+X)(729+88X+X²)+0·(475+124X+Y)+585+961X, whereby 585+961X is obtained as aremainder to generate a vector w⁽⁵⁾ ₁=(585,961).

[0324] Furthermore, divide M₅=X³ by I₂: then X³=(587+X)(180+422X+X²)+0·(989+423X+Y)+285+320X, whereby 285+320X is obtained as aremainder to generate a vector w⁽⁵⁾ ₂=(285,320). w⁽⁵⁾ ₁ and w⁽⁵⁾ ₂ areconnected to generate a vector v₅=(585,961,285,320). Next, divide M₆=XYby I₁: then XY=885 (729+88X+X²)+X·(475+124X+Y)+595+347X, whereby595+347X is obtained as a remainder to generate a vector w⁽⁶⁾₁=(595,347).

[0325] Furthermore, divide M₆=XY by I₂: thenXY=586(180+422X+X²)+X(989+423X+Y)+465+942X, whereby 465+942X is obtainedas a remainder to generate a vector w⁽⁶⁾ ₂=(465,942). w⁽⁶⁾ ₁ and w⁽⁶⁾ ₂are connected to generate a vector v₆=(595,347,465,942).

[0326] Finally, divide M₇=X⁴ by I₁: then X⁴=(961+921X+X²)(729+88X+X²)+0·(475+124X+Y)+686+773X, whereby, 686+773X is obtained as aremainder to generate a vector w⁽⁷⁾ ₁=(686,773). Furthermore, divideM₇=X⁴ by I₂: then X⁴=(320+587X+X²)(180+422X+X²)+0·(989+423X+Y)+922+451X, whereby 922+451X is obtained as aremainder to generate a vector w⁽⁷⁾ ₂=(922,451). w⁽⁷⁾ ₁ and w⁽⁷⁾ ₂ areconnected to generate a vector v₇=(686,773,922,451). Above, the processof the ideal composition section 11 in the monomial vector generationsection 22 is finished.

[0327] Next, in the basis construction section 23, the ideal compositionsection 11 inputs seven four-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆,and v₇ generated in the monomial vector generation section 22 into thelinear-relation derivation section 24, and obtains a plurality ofseven-dimensional vectors m₁, m₂, . . . as an output. Thelinear-relation derivation section 24 derives a linear relation of thevectors, which were input, employing the discharging method. Thedischarging method belongs to a known art, whereby, as to the operationof the linear-relation derivation section 24, only its outline is shownbelow. The linear-relation derivation section 24 firstly arranges theseven four-dimensional vectors v₁, v₂, v₃, v₄, v_(5,) v₆, and v₇, whichwere input, in order for constructing a 7×4 matrix $\begin{matrix}{M_{C} = \begin{pmatrix}1 & 0 & 1 & 0 \\0 & 1 & 0 & 1 \\280 & 921 & 829 & 587 \\534 & 885 & 20 & 586 \\585 & 961 & 285 & 320 \\595 & 347 & 465 & 942 \\686 & 773 & 922 & 451\end{pmatrix}} & \left\lbrack {{EQ}.\quad 29} \right\rbrack\end{matrix}$

[0328] Next, the linear-relation derivation section 24 connects aseven-dimensional unity matrix to the matrix M_(C) to obtain$\begin{matrix}{M_{C}^{\prime} = \begin{pmatrix}1 & 0 & 1 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\0 & 1 & 0 & 1 & 0 & 1 & 0 & 0 & 0 & 0 & 0 \\280 & 921 & 829 & 587 & 0 & 0 & 1 & 0 & 0 & 0 & 0 \\534 & 885 & 20 & 586 & 0 & 0 & 0 & 1 & 0 & 0 & 0 \\585 & 961 & 285 & 320 & 0 & 0 & 0 & 0 & 1 & 0 & 0 \\595 & 347 & 465 & 942 & 0 & 0 & 0 & 0 & 0 & 1 & 0 \\686 & 773 & 922 & 451 & 0 & 0 & 0 & 0 & 0 & 0 & 1\end{pmatrix}} & \left\lbrack {{EQ}.\quad 30} \right\rbrack\end{matrix}$

[0329] Next, the linear-relation derivation section 24 triangulates amatrix M′_(C) by adding a constant multiple of an i-th row to an(i+1)-th row (i=1,2, . . . ,4) to a seventh row to obtain the followinga matrix m. $\begin{matrix}{m = \begin{pmatrix}1 & 0 & 1 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\0 & 1 & 0 & 1 & 0 & 1 & 0 & 0 & 0 & 0 & 0 \\0 & 0 & 549 & 675 & 729 & 88 & 1 & 0 & 0 & 0 & 0 \\0 & 0 & 0 & 548 & 744 & 789 & 363 & 1 & 0 & 0 & 0 \\0 & 0 & 0 & 0 & 444 & 709 & 900 & 42 & 1 & 0 & 0 \\0 & 0 & 0 & 0 & 969 & 716 & 940 & 619 & 0 & 1 & 0 \\0 & 0 & 0 & 0 & 635 & 230 & 807 & 778 & 0 & 0 & 1\end{pmatrix}} & \left\lbrack {{EQ}.\quad 31} \right\rbrack\end{matrix}$

[0330] As well known, the vector that is composed of a fifth componentand afterward of a fifth row to a seventh row of the matrix m is avector (m_(1,1),m_(1,2), . . . ,m_(1,7)), (m_(2,1),m_(2,2), . . . ,m_(2,7)), . . . } representing a linearly-independent linear dependencerelation Σ_(i=1) ⁷m_(ji)v_(i)=0(j=1,2, . . .) of all of the sevenfour-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, and v₇ that were input.

[0331] The linear-relation derivation section 24 outputs a vectorm₁=(444,709,900,42,1,0,0) that is composed of the fifth component andafterward of the fifth row of the matrix m, a vectorm₂=(969,716,940,619,0,1,0) that is composed of the fifth component andafterward of the sixth row of the matrix m, and a vectorm₃=(635,230,807,778,0,0,1) that is composed of the fifth component andafterward of the seventh row of the matrix m.

[0332] Now return to the explanation of the process of the idealcomposition section 11 in the basis construction section 23. Next, theideal composition section 11 makes a reference to the table for aGroebner basis construction of FIG. 15, retrieves a record, of which thevalue of the order field is said value d₃=4, and in which a vector ofwhich the components that correspond to all component numbers describedin the component number list field are all zero does not lie in saidplurality of said vectors m₁=(444,709,900,42,1,0,0),m₂=(969,716,940,619,0,1,0), and m₃=(635,230,807,778,0,0,1). The value ofthe order field of a first record is 4, and a vector, of which thecomponents that correspond to the component number lists, 5, 6, and 7 ofthe first record are all zero, does not lie in the vectors m₁, m₂, andm₃, whereby the first record is obtained as a retrieval result.

[0333] Furthermore, the value of the first vector type of the firstrecord is (*,*,*,*,1,0,0)(A code * is interpreted as representing anynumber), which coincides with the vector m₁=(444,709,900,42,1,0,0),whereby the vector m₁ is regarded as a column of the coefficient of eachmonomial of the monomial order 1, X, X², Y, X³, XY, and X⁴ of thealgebraic curve parameter file A to generate a polynomialf₁=444+709X+900X²+42Y+X³.

[0334] Similarly, the value of the second vector type of the firstrecord is (*,*,*,*,0,1,0)(A code * is interpreted as representing anynumber), which coincides with the vector m₂=(969,716,940,619,0,1,0),whereby the vector m₂ is regarded as a column of the coefficient of eachmonomial of the monomial order 1, X, X², Y, X³, XY, and X⁴ of thealgebraic curve parameter file A to generate a polynomialf₂=969+716X+940X²+619Y+XY. The value of the third vector type of thefirst record is null, whereby it is neglected. Finally, the idealcomposition section 11 constructs a set J={f_(1,f)₂}={444+709X+900X²+42Y+X³,969+716X+940X²+619Y+XY} of the polynomial tooutput it. Above, the operation of the ideal composition section 11 isfinished.

[0335] Next, the first ideal reduction section 12, which takes as aninput the algebraic curve parameter file A of FIG. 12, and the Groebnerbases J={444+709X+900X²+42Y+X³, 969+716X+940X²+619Y+XY} that the idealcomposition section 11 output, operates as follows according to a flowof the process of the functional block shown in FIG. 3. At first, thefirst ideal reduction section 12 makes a reference to the ideal typetable of FIG. 12 in the ideal type classification section 31 of FIG. 3,retrieves a record in which the ideal type described in the ideal typefield accords with the type of the input ideal J for obtaining a firstrecord, and acquires a value N=41 of the ideal type number field and avalue d=2 of the reduction order field of the first record.

[0336] Next, the ideal reduction section 12 confirms that said value d=2is not zero, makes a reference to the monomial list table of FIG. 14 inthe polynomial vector generation section 32, retrieves a record of whichthe value of the order field is said d=2 for obtaining a third record,and acquires a list 1, X, X², and Y of the monomial described in themonomial list field of the third record. Furthermore, the idealreduction section 12 acquires a first element f=444+709X+900X²+42Y+X³,and a second element g=969+716X+940X²+619Y+XY of J (A third element doesnot lie in J, whereby a third polynomial h is not employed), regards acoefficient list 0, 7, 0, 0, 0, 0, 0, 0, 1, and 1 of the algebraic curveparameter file A as a column of the coefficient of each monomial of themonomial order 1, X, X², Y, X³, XY, X⁴, X²Y, X⁵, and Y² of the algebraiccurve parameter file A, and generates a defining polynomial F=Y²+X⁵+7X.

[0337] Next, for each of M_(i)(1<=i<=4) in said list 1, X, X², and Y ofsaid monomial, the ideal reduction section 12 calculates a remainderequation r_(i) of a product M_(i)·g of M_(i) and the polynomial g by thepolynomials f and F, arranges its coefficients in order of the monomialorder 1, X, X², Y, X³, XY, X⁴, and X²Y of the algebraic curve parameterfile A, and generates a vector v_(i). That is, at first, for a firstmonomial M₁=1, divide 1·g=969+716X+940X²+619Y+XY byf=444+709X+900X²+42Y+X³ and F=Y²+X⁵+7X: theng=0·f+0·F+969+716X+940X²+619Y+XY, whereby a remainder969+716X+940X²+619Y+XY is obtained to generate a vectorv₁=(969,716,940,619,0,1,0,0).

[0338] Next, a second monomial M₂=X, divide Xg=X(969+716X+940X²+619Y+XY)by f=444+709X+900X²+42Y+X³ and F=Y²+X⁵+7X: thenXg=940f+0·F+366+449X+258X²+880Y+619XY+X²Y, whereby a remainder366+449X+258X²+880Y+619XY+X²Y is obtained to generate a vectorv₂=(366,449,258,880,0,619,0,1).

[0339] Next, a third monomial M₃=X², divideX²g=X²(969+716X+940X²+619Y+XY) by f=444+709X+900X²+42Y+X³ andF=Y²+X⁵+7X: then X²g=(297+473X+42X²+Y)f+967F+311+462X+199X²+199Y+614XY+982X²Y, whereby a remainder311+462X+199X²+199Y+614XY+982X²Y is obtained to generate a vectorv₃=(311,462,199,199,0,614,0,982).

[0340] Finally, a fourth monomial M₄=Y, divideYg=Y(969+716X+940X²+619Y+XY) by f=444+709X+900X²+42Y+X³ and F=Y²+X⁵+7X:thenYg=(994+625X+27X²+1008X³+42Y)f+(873+X)F+606+463X+322X²+104Y+183XY+348X²Y,whereby a remainder 606+463X+322X²+104Y+183XY+348X²Y is obtained togenerate a vector v₄=(606,463,322,104,0,183,0,348). Above, the processof the ideal reduction section 12 in the polynomial vector generationsection 32 is finished.

[0341] Next, in the basis construction section 33, the first idealreduction section 12 inputs four eight-dimensional vectors v₁, v₂, v₃,and v₄ generated in the polynomial vector generation section 32 into thelinear-relation derivation section 34, and obtains a plurality offour-dimensional vectors m₁, m₂, . . . as an output. The linear-relationderivation section 34 derives a linear relation of the vectors, whichwere input, employing the discharging method. The discharging methodbelongs to a known art, whereby, as to the operation of thelinear-relation derivation section 34, only its outline is shown below.

[0342] The linear-relation derivation section 34 firstly arranges thefour eight-dimensional vectors v₁, v₂, v₃, and, v₄, which were input, inorder for constructing a 4×8 matrix $\begin{matrix}{M_{R} = \begin{pmatrix}969 & 716 & 940 & 619 & 0 & 1 & 0 & 0 \\366 & 449 & 258 & 880 & 0 & 619 & 0 & 1 \\311 & 462 & 199 & 199 & 0 & 614 & 0 & 982 \\606 & 463 & 322 & 104 & 0 & 183 & 0 & 348\end{pmatrix}} & \left\lbrack {{EQ}.\quad 32} \right\rbrack\end{matrix}$

[0343] Next, the linear-relation derivation section 34 connects afour-dimensional unity matrix to the matrix M_(R) to construct$\begin{matrix}{M_{R}^{\prime} = \begin{pmatrix}969 & 716 & 940 & 619 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 \\366 & 449 & 258 & 880 & 0 & 619 & 0 & 1 & 0 & 1 & 0 & 0 \\311 & 462 & 199 & 199 & 0 & 614 & 0 & 982 & 0 & 0 & 1 & 0 \\606 & 463 & 322 & 104 & 0 & 183 & 0 & 348 & 0 & 0 & 0 & 1\end{pmatrix}} & \left\lbrack {{EQ}.\quad 33} \right\rbrack\end{matrix}$

[0344] Next, the linear-relation derivation section 34 triangulates amatrix M′_(R) by adding a constant multiple of an i-th row to an(i+1)-th row (i=1,2) to a fourth row to obtain the following matrix m.$\begin{matrix}{m = \begin{pmatrix}969 & 716 & 940 & 619 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 \\0 & 341 & 787 & 848 & 0 & 275 & 0 & 1 & 665 & 1 & 0 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 835 & 27 & 1 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 312 & 661 & 0 & 1\end{pmatrix}} & \left\lbrack {{EQ}.\quad 34} \right\rbrack\end{matrix}$

[0345] As well known, the vector that is composed of a ninth componentand afterward of a third row and a fourth row of the matrix m is avector {(m_(1,1),m_(1,2), . . . ,m_(1,4)), (m_(2,1),m_(2,2), . . .,m_(2,4)),. . . } representing a linearly-independent linear dependencerelation Σ_(i=1) ⁴m_(ji)v_(i)=0(j=1,2, . . .) of all of the foureight-dimensional vectors v₁, v₂, v₃, and v₄ that were input. Thelinear-relation derivation section 34 outputs a vector m₁=(835,27,1,0)that is composed of the ninth component and afterward of the third rowof the matrix m, and a vector m₂=(312,661,0,1) that is composed of theninth component and afterward of the fourth row of the matrix m.

[0346] Now return to the explanation of the process of the first idealreduction section 12 in the basis construction section 33. Next, theideal reduction section 12 makes a reference to the table for a Groebnerbasis construction of FIG. 15, and retrieves a record, of which thevalue of the order field is said value d=2, and in which a vector ofwhich the components that correspond to all component numbers describedin the component number list field are all zero does not lie in saidplurality of said vectors m₁=(835,27,1,0), and m₂=(312,661,0,1). Thevalue of the order field of a sixth record is 2, and a vector, of whichthe components that correspond to the component number lists 3 and 4 ofthe sixth record are all zero, does not lie in the vectors m₁ and m₂,whereby the sixth record is obtained as a retrieval result.

[0347] Furthermore, the value of the first vector type of the sixthrecord is (*,*,1,0)(A code * is interpreted as representing any number),which coincides with the vector m₁=(835,27,1,0), whereby the vector m₁is regarded as a column of the coefficient of each monomial of themonomial order 1, X, X², and Y of the algebraic curve parameter file Ato generate a polynomial f₁=835+27X+X². Similarly, the value of thesecond vector type of the sixth record is (*,*,0,1)(A code * isinterpreted as representing any number), which coincides with the vectorm₂=(312,661,0,1), whereby the vector m₂ is regarded as a column of thecoefficient of each monomial of the monomial order 1, X, X^(2,)and Y ofthe algebraic curve parameter file A to generate a polynomialf₂=312+661X+Y. The value of the third vector type of the sixth record isnull, whereby it is neglected. Finally, the ideal reduction section 12constructs a set J*={f₁,f₂}={835+27X+X²,312+661X+Y} of the polynomial tooutput it. Above, the operation of the first ideal reduction section 12is finished.

[0348] Next, the second ideal reduction section 13, which takes as aninput the algebraic curve parameter file A of FIG. 12, and the Groebnerbasis J*={f₁,f₂}={835+27X+X²,312+661X+Y} that the first ideal reductionsection 12 output, operates as follows according to a flow of theprocess of the functional block shown in FIG. 3. At first, the secondideal reduction section 13 makes a reference to the ideal type table ofFIG. 13 in the ideal type classification section 31 of FIG. 3, retrievesa record in which the ideal type described in the ideal type fieldaccords with the type of the input ideal J* for obtaining a sixthrecord, and acquires a value N=21 of the ideal type number field and avalue d=2 of the reduction order field of the sixth record.

[0349] Next, the ideal reduction section 13 confirms that said value d=2is not zero, makes a reference to the monomial list table of FIG. 14 inthe polynomial vector generation section 32, retrieves a record of whichthe value of the order field is said d=2 for obtaining a third record,and acquires a list 1, X, X², and Y of the monomial described in themonomial list field of the third record. Furthermore, the idealreduction section 13 acquires a first element f=835+27X+X², and a secondelement g=312+661X+Y of J* (A third element does not lie in J*, wherebya third polynomial h is not employed), regards a coefficient list 0, 7,0, 0, 0, 0, 0, 0, 1, and 1 of the algebraic curve parameter file A as acolumn of the coefficient of each monomial of the monomial order 1, X,X², Y, X³, XY, X⁴, X²Y, X⁵, and Y² of the algebraic curve parameter fileA, and generates a defining polynomial F=Y2+X⁵+7X.

[0350] Next, for each of M_(i)(1<=i<=4) in said list 1, X, X² and Y ofsaid monomial, the ideal reduction section 13 calculates a remainderequation r_(i) of a product M_(i)·g of M_(i) and the polynomial g by thepolynomials f and F, arranges its coefficients in order of the monomialorder 1, X, X², Y, X³, XY, X⁴, and X²Y of the algebraic curve parameterfile A, and generates a vector v_(i). That is, at first, for a firstmonomial M₁=1, divide 1·g=312+661X+Y by f=835+27X+X² and F=Y²+X⁵+7X:then g=0·f+0·F+312+661X+Y, whereby a remainder 312+661X+Y is obtained togenerate a vector v₁=(312,661,0,1,0,0).

[0351] Next, a second monomial M₂=X, divide Xg=X(312+661X+Y) byf=835+27X+X² and F=Y²+X⁵+7X: then Xg=661f+0·F+997+627X+XY, whereby aremainder 997+627X+XY is obtained to generate a vectorv₂=(997,627,0,0,0,1). Next, a third monomial M₃=X², divideX²g=X²(312+661X+Y) by f=835+27X+X² and F=Y²+X⁵+7X: thenX²g=(627+661X+Y)f+0·F+126+212X+174Y+982XY, whereby a remainder126+212X+174Y+982XY is obtained to generate a vectorv₃=(126,212,0,174,0,982).

[0352] Finally, a fourth monomial M₄=Y, divide Yg=Y(312+661X+Y) byf=835+27X+X² and F=Y²+X⁵+7X: then Yg=(827+106X+27X²+1008X³)f+1·F+620+144X+312Y+661XY, whereby a remainder 620+144X+312Y+661XY isobtained to generate a vector v₄=(620,144,0,312,0,661). Above, theprocess of the second ideal reduction section 13 in the polynomialvector generation section 32 is finished.

[0353] Next, in the basis construction section 33, this second idealreduction section 13 inputs four six-dimensional vectors v₁, v₂, v₃, andv₄ generated in the polynomial vector generation section 32 into thelinear-relation derivation section 34, and obtains a plurality offour-dimensional vectors m₁, m₂, . . . as an output. The linear-relationderivation section 34 derives a linear relation of the vectors, whichwere input, employing the discharging method. The discharging methodbelongs to a known art, whereby, as to the operation of thelinear-relation derivation section 34, only its outline is shown below.

[0354] The linear-relation derivation section 34 firstly arranges thefour six-dimensional vectors v₁, v₂, v₃, and, v₄, which were input, inorder for constructing a 4×6 matrix $\begin{matrix}{M_{R} = \begin{pmatrix}312 & 661 & 0 & 1 & 0 & 0 \\997 & 627 & 0 & 0 & 0 & 1 \\126 & 212 & 0 & 174 & 0 & 982 \\620 & 144 & 0 & 312 & 0 & 661\end{pmatrix}} & \left\lbrack {{EQ}.\quad 35} \right\rbrack\end{matrix}$

[0355] Next, the linear-relation derivation section 34 connects afour-dimensional unity matrix to the matrix M_(R) to construct$\begin{matrix}{M_{R}^{\prime} = \begin{pmatrix}312 & 661 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 \\997 & 627 & 0 & 0 & 0 & 1 & 0 & 1 & 0 & 0 \\126 & 212 & 0 & 174 & 0 & 982 & 0 & 0 & 1 & 0 \\620 & 144 & 0 & 312 & 0 & 661 & 0 & 0 & 0 & 1\end{pmatrix}} & \left\lbrack {{EQ}.\quad 36} \right\rbrack\end{matrix}$

[0356] Next, the linear-relation derivation section 34 triangulates amatrix M′_(R) by adding a constant multiple of an i-th row to an(i+1)-th row (i=1,2) to a fourth row to obtain the following matrix m.$\begin{matrix}{m = \begin{pmatrix}312 & 661 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 \\0 & 536 & 0 & 815 & 0 & 1 & 815 & 1 & 0 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 835 & 27 & 1 & 0 \\0 & 0 & 0 & 0 & 0 & 0 & 697 & 348 & 0 & 1\end{pmatrix}} & \left\lbrack {{EQ}.\quad 37} \right\rbrack\end{matrix}$

[0357] As well known, the vector that is composed of a seventh componentand afterward of a third row and a fourth row of the matrix m is avector {(m_(1,1),m_(1,2), . . . ,m_(1,4)), (m_(2,1),m_(2,2), . . .,m_(2,4)), . . . } representing a linearly-independent linear dependencerelation Σ_(i=1) ⁴m_(ji)v_(i)=0(j=1,2, . . .) of all of the foursix-dimensional vectors v₁, v₂, v₃, and v₄ that were input.

[0358] The linear-relation derivation section 34 outputs a vectorm₁=(835,27,1,0) that is composed of the seventh component and afterwardof the third row of the matrix m, and a vector m₂=(697,348,0,1) that iscomposed of the seventh component and afterward of the fourth row of thematrix m. Now return to the explanation of the process of the idealreduction section 13 in the basis construction section 33. Next, theideal reduction section 13 makes a reference to the table for a Groebnerbasis construction of FIG. 15, retrieves a record, of which the value ofthe order field is said value d=2, and in which a vector of which thecomponents that correspond to all component numbers described in thecomponent number list field are all zero does not lie in said pluralityof said vectors m₁=(835,27,1,0), and m₂=(697,348,0,1). The value of theorder field of a sixth record is 2, and a vector, of which the componentnumber lists 3 and 4 of the sixth record are all zero, does not lie inthe vectors m₁, and m₂, whereby the sixth record is obtained as aretrieval result.

[0359] Furthermore, the value of the first vector type of the sixthrecord is (*,*,1,0)(A code * is interpreted as representing any number),which coincides with the vector m₁=(835,27,1,0), whereby the vector m₁is regarded as a column of the coefficient of each monomial of themonomial order 1, X, X², and Y of the algebraic curve parameter file Ato generate a polynomial f₁=835+27X+X². Similarly, the value of thesecond vector type of the sixth record is (*,*,0,1)(A code * isinterpreted as representing any number), which coincides with the vectorm₂=(697,348,0,1), whereby the vector m₂ is regarded as a column of thecoefficient of each monomial of the monomial order 1, X, X²,and Y of thealgebraic curve parameter file A to generate a polynomial f₂=697+348X+Y.The value of the third vector type of the sixth record is null, wherebyit is neglected. Finally, the ideal reduction section 13 constructs aset J**={f₁,f₂}={835+27X+X²,697+348X+Y} of the polynomial to output it.Above, the operation of the ideal reduction section 13 is finished.Finally, in the Jacobian group adder of FIG. 1, the Groebner basisJ**={835+27X+X²,697+348X+Y}, which the second ideal reduction section 13output, is output from the output apparatus.

[0360] The effect exists: employment of the present invention allows theaddition in the Jacobian group of the C_(ab) curve to be calculated at ahigh speed, and practicality of the C_(ab) curve to be enhanced.

[0361] The present invention has been described with reference to thepreferred embodiments. However, it will be appreciated by those skilledin the relevant field that a number of other embodiments, differing fromthose specifically described, will also fall within the sprit and scopeof the present invention. Accordingly, it will be understood that theinvention is not intended to be limited to the embodiments described inthe specification. The scope of the invention is only limited byattached claims.

[0362] The entire disclosure of Japanese Patent Application No.2002-240034 filed on Aug. 21, 2002 including specification, claims,drawing and summary are incorporated herein by reference in itsentirety.

What is claimed is: 1 A Jacobian group element adder, which is anarithmetic unit for executing addition in a Jacobian group of analgebraic curve defined by a polynomial defined over a finite field thatis Y³+α₀X⁴+α₁XY²+α₂X²Y+α₃X³+α₄Y²+α₅XY+α₆X²+α₇Y+α₈X+α₉ orY²+α₀X⁵+α₁X²Y+α₂X⁴+α₃XY+α₄X³+α₅Y+α₆X²+α₇X+α₈ orY²+α₀X⁷+α₁X³Y+α₂X⁶+α₃X²Y+α₄X⁵+α₅XY+α₆X⁴+α₇Y+α₈X³+α₉X²+α₁₀X+α₁₁, saidJacobian group element adder comprising: means for inputting analgebraic curve parameter file having an order of a field of definition,a monomial order, and a coefficient list described as a parameterrepresenting said algebraic curve; means for inputting Groebner bases I₁and I₂ of ideals of the coordinate ring of the algebraic curvedesignated by said algebraic curve parameter file, said Groebner basesrepresenting elements of said Jacobian group; ideal reduction means for,in the coordinate ring of the algebraic curve designated by saidalgebraic curve parameter file, performing arithmetic of producing aGroebner basis J of the ideal which is a product of the ideal that theGroebner basis I₁ generates, and the ideal that the Groebner basis I₂generates; first ideal reduction means for, in the coordinate ring ofthe algebraic curve designated by said algebraic curve parameter file,performing arithmetic of producing a Groebner basis J* of the ideal,which is smallest in the monomial order designated by said algebraiccurve parameter file among the ideals equivalent to an inverse ideal ofthe ideal that the Groebner basis J generates; and second idealreduction means for, in the coordinate ring of the algebraic curvedesignated by said algebraic curve parameter file, performing arithmeticof producing a Groebner basis J** of the ideal, which is smallest in themonomial order designated by said algebraic curve parameter file amongthe ideals equivalent to an inverse ideal of the ideal that the Groebnerbasis J* generates, to output it. 2 The Jacobian group element adderaccording to claim 1, wherein said ideal composition means has:linear-relation derivation means for, for a plurality of vectors v₁, v₂,. . . , and v_(n) that were input, outputting a plurality of vectors {m₁(m_(1,1)m_(1,2), . . . ,m_(1,n)),m₂=(m_(2,1),m_(2,2), . . . , m_(2,n)),. . . } representing linear dependence relationsΣ_(i)m_(j,i)v_(i)=0(j=1,2, . . .) of all of them employing a dischargingmethod; an ideal type table that is composed of a record number field,an ideal type number field, an order field, and an ideal type field; amonomial list table that is composed of the record number field, theorder field, and a monomial list field; a table for a Groebner basisconstruction that is composed of the record number field, the orderfield, a component number list field, a first vector type field, asecond vector type field, and a third vector type field; ideal typeclassification means for acquiring said algebraic curve parameter fileto make a reference to said ideal type table for each of Groebner basesI₁ and I₂ that were input, to retrieve a record in which the ideal typedescribed in the ideal type field accords with the type of an inputideal I_(i)(i=1,2), and to acquire a value N_(i) of the ideal typenumber field and a value d_(i) of the order field of the retrievedrecord; monomial vector generation means for calculating a sum d₃=d₁+d₂of said values d₁ and d₂ of said order field to make a reference to saidmonomial list table for retrieving a record R of which a value of theorder field is said d₃, to acquire a list M₁, M₂, . . . of the monomialdescribed in said monomial list field of said record R, when I₁ and I₂are different, to calculate a remainder equation r₁ of dividing eachsaid monomial M_(i) by I₁, to generate a vector w^((i)) ₁ that iscomposed of coefficients of the remainder equation r_(i) according tothe monomial order described in said algebraic curve parameter file,furthermore to calculate a remainder equation s_(i) of dividing M_(i) byI₂, to generate a vector w^((i)) ₂ that is composed of coefficients ofthe remainder equation s_(i) according to the monomial order describedin an algebraic curve parameter file A, to connect the above-mentionedtwo vectors w^((i)) ₁ and w^((i)) ₂ for generating a vector v_(i), also,when I₁ and I₂ are equal, to calculate a remainder equation r_(i) ofdividing each said monomial M_(i) by I₁, to generate a vector w^((i)) ₁that is composed of coefficients of the remainder equation r_(i)according to the monomial order described in said algebraic curveparameter file, furthermore to construct a defining polynomial Femploying the coefficient list and the monomial order described in saidalgebraic curve parameter file, when a differential of a polynomial Mwith regard to by its X is expressed by D_(X)(M), and a differential ofthe polynomial M with regard to by its Y is expressed by D_(Y)(M), tocalculate a remainder equation s_(i) of dividing a polynomialD_(X)(M_(i))D_(Y)(F)−D_(Y)(M_(i))D_(X)(F) by I₁, to generate a vectorw^((i)) ₂ that is composed of coefficients of the remainder equations_(i) according to the monomial order described in said algebraic curveparameter file, and to connect the above-mentioned two vectors w^((i)) ₁and w^((i)) ₂ for generating a vector v_(i); and basis constructionmeans for inputting said plurality of said vectors v₁, v₂, . . . intosaid linear-relation derivation means, to acquire a plurality of vectorsm₁, m₂, . . . as an output, to make an reference to said table for aGroebner basis construction for retrieving a record R₂, of which a valueof the order field is said value d₃, and in which a vector of which thecomponents that correspond to all component numbers described in thecomponent number list field are all zero does not lie in said pluralityof said vectors m₁, m₂, . . . , to select a vector m that accords with afirst vector type of said record R₂ from among said plurality of saidvectors m₁, m₂, . . . , to generate a polynomial f₁ of which thecoefficient is a value of a component of the vector m according to themonomial order described in said algebraic curve parameter file,hereinafter, similarly, to generate a polynomial f₂ employing a vectorthat accords with a second vector type, and also a polynomial f₃employing a vector that accords with a third vector type, to obtain aset J={f₁,f₂,f₃} of the polynomial, and to output it as said Groebnerbasis J. 3 The Jacobian group element adder according to one of claim 1and claim 2, wherein each of said first and said second ideal reductionmeans has: linear-relation derivation means for, for a plurality ofvectors v₁, v₂, . . . , and v_(n) that were input, outputting aplurality of vectors m₁=(m_(1,1), m_(1,2), . . . ,m_(1,n)),m₂=(m_(2,1),m_(2,2), . . . ,m_(2,n)), . . . } representinglinear dependence relations Σ_(i)m_(ji)v_(i)=0(j=1,2 ) of all of thememploying a discharging method; an ideal type table that is composed ofthe record number field, the ideal type number field, a reduction orderfield, and the ideal type field; a monomial list table that is composedof the record number field, the order field, and the monomial listfield; a table for a Groebner basis construction that is composed of therecord number field, the order field, the component number list field,the first vector type field, the second vector type field, and the thirdvector type field; ideal type classification means for acquiring saidalgebraic curve parameter file to make a reference to said ideal typetable, to retrieve a record in which the ideal type described in theideal type field accords with the type of an input ideal J, to acquiresa value N of the ideal type number field and a value d of the reductionorder field of the retrieved record; polynomial vector generation meansfor, when said d is zero, outputting the input ideal J as said Groebnerbasis J*, when said d is not zero, to make a reference to said monomiallist table for retrieving a record R of which a value of the order fieldis said d, to acquire a list M₁, M₂, . . . of the monomial described inthe monomial list field of said record R₁ to construct a definingpolynomial F employing the coefficient list and the monomial orderdescribed in said algebraic curve parameter file, to acquire a firstpolynomial f, a second polynomial g, and a third polynomial h of theinput ideal J, to calculate a remainder equation r_(i) of a productM_(i)·g of each said monomial M_(i) and the polynomial g by thepolynomials f and F, to generate a vector w^((i)) ₁ that is composed ofcoefficients of the remainder equation r_(i) according to the monomialorder described in said algebraic curve parameter file, furthermore tocalculate a remainder equation s_(i) of a product M_(i)·h of each saidmonomial M_(i) and the polynomial h by the polynomials f and F, togenerate a vector w^((i)) ₂ that is composed of coefficients of theremainder equation s_(i) according to the monomial order described insaid algebraic curve parameter file, and to connect the above-mentionedtwo vectors w^((i)) ₁ and w^((i)) ₂ for generating a vector v_(i); andbasis construction means for inputting said plurality of said vectorsv₁, v₂, . . . into said linear-relation derivation means, to obtain aplurality of vectors m₁, m₂, . . . as an output, to make a reference tosaid table for a Groebner basis construction for retrieving a record R₂of which a value of the order field is said value d, and in which avector of which the components that correspond to all component numbersdescribed in the component number list field are all zero does not liein said plurality of said vectors m₁, m₂, . . . , to select a vector mthat accords with a first vector type of said record R₂ from among saidplurality of said vectors m₁, m₂, . . . , to generate a polynomial f₁ ofwhich a coefficient is a value of the component of the vector maccording to the monomial order described in said algebraic curveparameter file, hereinafter, similarly, to generate a polynomial f₂employing the vector that accords with a second vector type, and also apolynomial f₃ employing the vector that accords with a third vectortype, to obtain a set {f₁,f₂,f₃} of the polynomial, and to output it assaid Groebner basis J* or J**. 4 A record medium having a programrecorded for causing an information processing unit configuring anarithmetic unit for executing addition in a Jacobian group of analgebraic curve defined by a polynomial defined over a finite field thatis Y³+α₀X⁴+α₁XY²+α₂X²Y+α₃X³+α₄Y²+α₅XY+α₆X²+α₇Y+α₈X+α₉ orY²+α₀X⁵+α₁X²Y+α₂X⁴+α₃XY+α₄X³+α₅Y+α₆X²+α₇X+α₈ orY²+α₀X⁷+α₁X³Y+α₂X⁶+α₃X²Y+α₄X⁵+α₅XY+α₆X⁴+α₇Y+α₈X³+α₉X²+α₁₀X+α₁₁ toperform: a process of inputting an algebraic curve parameter file havingan order of a field of definition, a monomial order, and a coefficientlist described as a parameter representing said algebraic curve; aprocess of inputting Groebner bases I₁ and I₂ of ideals of thecoordinate ring of the algebraic curve designated by said algebraiccurve parameter file, said Groebner bases representing an element ofsaid Jacobian group; an ideal composition process of, in the coordinatering of the algebraic curve designated by said algebraic curve parameterfile, performing arithmetic of producing a Groebner basis J of an idealwhich is a product of the ideal that the Groebner basis I₁ generates,and an ideal that the Groebner basis I₂ generates; a first idealreduction process of, in the coordinate ring of the algebraic curvedesignated by said algebraic curve parameter file, performing arithmeticof producing a Groebner basis J* of the ideal, which is smallest in themonomial order designated by said algebraic curve parameter file amongthe ideals equivalent to an inverse ideal of the ideal that the Groebnerbasis J generates; and a second ideal reduction process of, in thecoordinate ring of the algebraic curve designated by said algebraiccurve parameter file, performing arithmetic of producing a Groebnerbasis J** of the ideal, which is smallest in the monomial orderdesignated by said algebraic curve parameter file among the idealsequivalent to an inverse ideal of the ideal that the Groebner basis J*generates, to output it, said record medium being readable by saidinformation processing unit. 5 The record medium according to claim 4,said record medium having a program recorded for causing saidinformation processing unit to further perform in said ideal compositionprocess: a linear-relation derivation process of, for a plurality ofvectors v₁, v₂, . . . , and v_(n) that were input, outputting aplurality of vectors {m₁=(m_(1,1),m_(2,1), . . .,m_(1,n)),m₂=(m_(2,1),m_(2,2), . . . ,m_(2,n)), . . . } representinglinear dependence relations Σ_(i)m_(j,i)v_(i)=0(j=1,2, . . .) of all ofthem employing a discharging method; an ideal type classificationprocess of acquiring said algebraic curve parameter file to make areference to an ideal type table, which is composed of a record numberfield, an ideal type number field, an order field, and an ideal typefield, for each of Groebner bases I₁ and I₂ that were input, to retrievea record in which the ideal type described in the ideal type fieldaccords with the type of an input ideal I_(i)(i=1,2), and to acquire avalue N_(i) of the ideal type number field and a value d_(i) of theorder field of the retrieved record; a monomial vector generationprocess of calculating a sum d₃=d₁+d₂ of said values d₁ and d₂ of saidorder field to make a reference to a monomial list table, which iscomposed of the record number field, the order field, and a monomiallist field, for retrieving a record R of which a value of the orderfield is said d₃, to acquire a list M₁, M₂, . . . of the monomialdescribed in said monomial list field of said record R₁ when I₁ and I₂are different, to calculate a remainder equation r_(i) of dividing eachsaid monomial M_(i) by I₁, to generate a vector w^((i)) ₁ that iscomposed of coefficients of the remainder equation r_(i) according tothe monomial order described in said algebraic curve parameter file,furthermore to calculate a remainder equation s_(i) of dividing M_(i) byI₂, to generate a vector w^((i)) ₂ that is composed of coefficients ofthe remainder equation s_(i) according to the monomial order describedin an algebraic curve parameter file A, to connect the above-mentionedtwo vectors w^((i)) ₁ and w^((i)) ₂ for generating a vector v₁, also,when I₁ and I₂ are equal, to calculate a remainder equation r_(i) ofdividing each said monomial M_(i) by I₁, to generate a vector w^((i)) ₁that is composed of coefficients of the remainder equation r_(i)according to the monomial order described in said algebraic curveparameter file, furthermore to construct a defining polynomial Femploying the coefficient list and the monomial order described in saidalgebraic curve parameter file, when a differential of a polynomial Mwith regard to by its X is expressed by D_(X)(M), and a differential ofthe polynomial M with regard to by its Y is expressed by D_(Y)(M), tocalculate a remainder equation s_(i) of dividing a polynomialD_(X)(M_(i))D_(Y)(F)−D_(Y)(M_(i))D_(X)(F) by I₁, to generate a vectorw^((i)) ₂ that is composed of coefficients of the remainder equations_(i) according to the monomial order described in said algebraic curveparameter file, and to connect the above-mentioned two vectors w^((i)) ₁and w^((i)) ₂ for generating a vector v_(i); and a basis constructionprocess of obtaining a plurality of vectors m₁, m₂, . . . output in saidlinear-relation derivation process, to make an reference to a table fora Groebner basis construction, which is composed of the record numberfield, the order field, a component number list field, a first vectortype field, a second vector type field, and a third vector type field,for retrieving a record R₂, of which a value of the order field is saidvalue d₃, and in which a vector of which the components that correspondto all component numbers described in the component number list fieldare all zero does not lie in said plurality of said vectors m₁, m₂, . .. , to select a vector m that accords with a first vector type of saidrecord R₂ from among said plurality of said vectors m₁, m₂, . . . , togenerate a polynomial f₁ of which the coefficient is a value of acomponent of the vector m according to the monomial order described insaid algebraic curve parameter file, hereinafter, similarly, to generatea polynomial f₂ employing a vector that accords with a second vectortype, and also a polynomial f₃ employing a vector that accords with athird vector type, to obtain a set J={f₁,f₂,f₃} of the polynomial, andto output it as said Groebner basis J. 6 The record medium according toone of claim 4 and claim 5, said record medium having a program recordedfor causing said information processing to further perform in each ofsaid first and second ideal reduction processes: a linear-relationderivation process of, for a plurality of vectors v₁, v₂, . . . , andv_(n) that were input, outputting a plurality of vectors{m₁=(m_(1,1),m_(1,2), . . . ,m_(1,n)),m₂=(m_(2,1),m_(2,2), . . .,m_(2,n)), . . . } representing linear dependence relationsΣ_(i)m_(j,i)v_(i)=0(j=1,2, . . .) of all of them employing a dischargingmethod; an ideal type classification process of acquiring said algebraiccurve parameter file to make a reference to a ideal type table, which iscomposed of the record number field, the ideal type number field, areduction order field, and the ideal type field, to retrieve a record inwhich the ideal type described in the ideal type field accords with thetype of an input ideal J, and to acquire a value N of the ideal typenumber field and a value d of the reduction order field of the retrievedrecord; a polynomial vector generation process of, when said d is zero,outputting the input ideal J as said Groebner basis J*, when said d isnot zero, to make a reference to a monomial list table, which iscomposed of the record number field, the order field, and the monomiallist field, for retrieving a record R of which a value of the orderfield is said d, to acquire a list M₁, M₂, . . . of the monomialdescribed in the monomial list field of said record R, to construct adefining polynomial F employing the coefficient list and the monomialorder described in said algebraic curve parameter file, to acquire afirst polynomial f, a second polynomial g, and a third polynomial h ofthe input ideal J, to calculate a remainder equation r_(i) of a productM_(i)·g of each said monomial M_(i) and said polynomial g by thepolynomials f and F, to generate a vector w^((i)) ₁ that is composed ofcoefficients of the remainder equation r_(i) according to the monomialorder described in said algebraic curve parameter file, furthermore tocalculate a remainder equation s_(i) of a product M_(i)·h of each saidmonomial M_(i) and the polynomial h by the polynomials f and F, togenerate a vector w^((i)) ₂ that is composed of coefficients of theremainder equation s_(i) according to the monomial order described insaid algebraic curve parameter file, and to connect the above-mentionedtwo vectors w^((i)) ₁ and w^((i)) ₂ for generating a vector v_(i); and abasis construction process of obtaining a plurality of vectors m₁, m₂, .. . output in said linear-relation derivation process to make areference to a table for a Groebner basis construction, which iscomposed of the record number field, the order field, the componentnumber list field, the first vector type field, the second vector typefield, and the third vector type field, for retrieving a record R₂ ofwhich a value of the order field is said value d, and in which a vectorof which the components that correspond to all component numbersdescribed in the component number list field are all zero does not liein said plurality of said vectors m₁, m₂, . . . , to select a vector mthat accords with a first vector type of said record R₂ from among saidplurality of said vectors m₁, m₂, . . . , to generate a polynomial f₁ ofwhich a coefficient is a value of the component of the vector maccording to the monomial order described in said algebraic curveparameter file, hereinafter, similarly, to generate a polynomial f₂employing the vector that accords with a second vector type, and also apolynomial f₃ employing the vector that accords with a third vectortype, to obtain a set {f₁,f₂,f₃} of the polynomial, and to output it assaid Groebner basis J* or J**.